Wallet state is reused as Authorization Server state

EWC-consortium / ewc-wallet-conformance-backend

This is the EWC Interoperability Test Bed (ITB) and implements the conformance towards EWC RFCs; build towards the Large Scale Pilot (LSP) usecases. The project is co-funded by the European Union.

3 stars 1 forks source link

Wallet state is reused as Authorization Server state #14

Open pa-rw opened 1 month ago

pa-rw commented 1 month ago

https://github.com/EWC-consortium/ewc-wallet-conformance-backend/blob/1414291b6608e0ce8e3166d7878cedc3c950faab/routes/codeFlowJwtRoutes.js#L140-L141

Following this guidelines https://hub.ebsi.eu/conformance/learn/verifiable-credential-issuance#id-token-response, parameter state should not be copied from the Authorization request (wallet-defined state). A new value (server-defined state) should be generated for the VP (or is it ID?) Token Request.