FHIR-55945 - Clarify trailing slash handling for FHIR base URLs

input/pagecontent/changelog.md

@@ -8,6 +8,7 @@ In addition to the tickets below, this version includes changes necessary to mov
 |---------|----------|
 |[FHIR-56931](https://jira.hl7.org/browse/FHIR-56931)|Move common requirements to a separate menu bar tab|
 |[FHIR-57937](https://jira.hl7.org/browse/FHIR-57937)|Clarify that complete redirection URIs are required for registraton|
+|[FHIR-55945](https://jira.hl7.org/browse/FHIR-55945)|Clarify trailing slash handling for FHIR base URLs|
 
 ### Version 2.0.0
 

input/pagecontent/general.md

@@ -84,7 +84,7 @@ Additional JWT Claim requirements are defined elsewhere in this guide.
 
 This guide does not require the canonicalization of URIs included in JWTs before making string comparisons. Per Section 2 of [RFC 7519], URI values in JWTs are compared as case-sensitive strings with no transformations or canonicalizations applied. The JWT producer **SHOULD** include URI values that are normalized to facilitate successful string matching by the JWT consumer. The JWT consumer is **NOT REQUIRED** to perform any normalization of URI values prior to making comparisons. For example, a JWT producer cannot assume that a JWT consumer will consider `"https://FHIR.example.com:443"` and `"https://fhir.example.com/"` to be equivalent strings when evaluating a JWT.
 
-Note: To ensure interoperability, a URI included as the `iss` value of a JWT should exactly match a URI included in the Subject Alternative Name extension of the JWT producer's corresponding certificate, including, for example, the case used for the host name and the presence or absence of a port number or trailing slash. Similarly, clients that include a URI provided by a server in its server metadata as the `aud` value of a JWT subsequently submitted to that server should include the URI exactly as it was originally provided by that server.
+Note: To ensure interoperability, a URI included as the `iss` value of a JWT should exactly match a URI included in the Subject Alternative Name extension of the JWT producer's corresponding certificate, including, for example, the case used for the host name and the presence or absence of a port number or trailing slash. OAuth-related specifications commonly use URI normalization rules that may treat a trailing slash differently than a URL without one, but FHIR base URLs are defined without a trailing slash; therefore, the URI values used in this guide should match exactly, and FHIR base URLs should not include a trailing slash. Similarly, clients that include a URI provided by a server in its server metadata as the `aud` value of a JWT subsequently submitted to that server should include the URI exactly as it was originally provided by that server.
 
 #### JWT validation