From aa9944e31d6e318fcba094a8c9e6737fd85fe632 Mon Sep 17 00:00:00 2001 From: JohnMoehrke Date: Fri, 7 Aug 2026 11:03:35 -0500 Subject: [PATCH 1/2] Clarify trailing slash handling for FHIR base URLs [FHIR-55945] --- input/pagecontent/general.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/input/pagecontent/general.md b/input/pagecontent/general.md index bcdb1f0..4447557 100644 --- a/input/pagecontent/general.md +++ b/input/pagecontent/general.md @@ -84,7 +84,7 @@ Additional JWT Claim requirements are defined elsewhere in this guide. This guide does not require the canonicalization of URIs included in JWTs before making string comparisons. Per Section 2 of [RFC 7519], URI values in JWTs are compared as case-sensitive strings with no transformations or canonicalizations applied. The JWT producer **SHOULD** include URI values that are normalized to facilitate successful string matching by the JWT consumer. The JWT consumer is **NOT REQUIRED** to perform any normalization of URI values prior to making comparisons. For example, a JWT producer cannot assume that a JWT consumer will consider `"https://FHIR.example.com:443"` and `"https://fhir.example.com/"` to be equivalent strings when evaluating a JWT. -Note: To ensure interoperability, a URI included as the `iss` value of a JWT should exactly match a URI included in the Subject Alternative Name extension of the JWT producer's corresponding certificate, including, for example, the case used for the host name and the presence or absence of a port number or trailing slash. Similarly, clients that include a URI provided by a server in its server metadata as the `aud` value of a JWT subsequently submitted to that server should include the URI exactly as it was originally provided by that server. +Note: To ensure interoperability, a URI included as the `iss` value of a JWT should exactly match a URI included in the Subject Alternative Name extension of the JWT producer's corresponding certificate, including, for example, the case used for the host name and the presence or absence of a port number or trailing slash. OAuth-related specifications commonly use URI normalization rules that may treat a trailing slash differently than a URL without one, but FHIR base URLs are defined without a trailing slash; therefore, the URI values used in this guide should match exactly, and FHIR base URLs should not include a trailing slash. Similarly, clients that include a URI provided by a server in its server metadata as the `aud` value of a JWT subsequently submitted to that server should include the URI exactly as it was originally provided by that server. #### JWT validation From 6d5edec9d881acc70f0acbff5111e54a14403496 Mon Sep 17 00:00:00 2001 From: JohnMoehrke Date: Fri, 7 Aug 2026 11:27:31 -0500 Subject: [PATCH 2/2] Add changelog entry for trailing slash clarification [FHIR-55945] --- input/pagecontent/changelog.md | 1 + 1 file changed, 1 insertion(+) diff --git a/input/pagecontent/changelog.md b/input/pagecontent/changelog.md index 7121fde..f6e25ec 100644 --- a/input/pagecontent/changelog.md +++ b/input/pagecontent/changelog.md @@ -8,6 +8,7 @@ In addition to the tickets below, this version includes changes necessary to mov |---------|----------| |[FHIR-56931](https://jira.hl7.org/browse/FHIR-56931)|Move common requirements to a separate menu bar tab| |[FHIR-57937](https://jira.hl7.org/browse/FHIR-57937)|Clarify that complete redirection URIs are required for registraton| +|[FHIR-55945](https://jira.hl7.org/browse/FHIR-55945)|Clarify trailing slash handling for FHIR base URLs| ### Version 2.0.0