Sphereon-Opensource / OID4VC

OpenID for Verifiable Credentials - modules for issuers, holders and RPs
Apache License 2.0
62 stars 19 forks source link

Utilize nonce from server response for subsequent client calls #110

Open Haza85 opened 3 months ago

Haza85 commented 3 months ago

Hello, I've observed that the OpenID4VCIClient consistently utilizes the nonce from the access token acquisition response. However, there's a scenario where we need to make multiple sequential calls to the server to retrieve credentials using the same access token. In this case, each request requires a nonce from the preceding server response. Presently, the implementation relies on the same nonce for each request, resulting in the failure of subsequent requests due to nonce invalidity.

nklomp commented 3 months ago

Yeah you are correct, this is something we will be fixing after support for Draft 13 lands, of which a first version will land this week