Sphereon-Opensource / OID4VCI

OpenID for Verifiable Credential Issuance - client and issuer library
Apache License 2.0
56 stars 17 forks source link

Utilize nonce from server response for subsequent client calls #110

Open Haza85 opened 1 month ago

Haza85 commented 1 month ago

Hello, I've observed that the OpenID4VCIClient consistently utilizes the nonce from the access token acquisition response. However, there's a scenario where we need to make multiple sequential calls to the server to retrieve credentials using the same access token. In this case, each request requires a nonce from the preceding server response. Presently, the implementation relies on the same nonce for each request, resulting in the failure of subsequent requests due to nonce invalidity.

nklomp commented 1 month ago

Yeah you are correct, this is something we will be fixing after support for Draft 13 lands, of which a first version will land this week