Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Require typ in request objects #355

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Require typ in request objects #355

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d263e13
Require typ in request objects
jogu Nov 30, 2024
6aa86c2
Apply Paul's suggestion
jogu Dec 9, 2024
2bc1420
Merge remote-tracking branch 'origin/main' into typ-in-request-obj
jogu Dec 19, 2024
7c0288e
Add changelog entry
jogu Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion openid-4-verifiable-presentations-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,7 +250,7 @@ Presentation of Verifiable Credentials using OpenID for Verifiable Presentations

The Authorization Request follows the definition given in [@!RFC6749] taking into account the recommendations given in [@!I-D.ietf-oauth-security-topics].

The Verifier MAY send an Authorization Request as a Request Object either by value or by reference, as defined in the JWT-Secured Authorization Request (JAR) [@RFC9101].
The Verifier MAY send an Authorization Request as a Request Object either by value or by reference, as defined in the JWT-Secured Authorization Request (JAR) [@RFC9101]. Verifiers MUST include the `typ` Header Parameter in Request Objects with the value `oauth-authz-req+jwt`, as defined in [@RFC9101]. Wallets MUST NOT process Request Objects where the `typ` Header Parameter is not present or does not have the value `oauth-authz-req+jwt`.

This specification defines a new mechanism for the cases when the Wallet wants to provide to the Verifier details about its technical capabilities to
allow the Verifier to generate a request that matches the technical capabilities of that Wallet.
Expand Down Expand Up @@ -2709,6 +2709,7 @@ The technology described in this specification was made available from contribut

-24

* require `typ` value in request object to be `oauth-authz-req+jwt`

-23

Expand Down
Loading