eu-digital-identity-wallet / eudi-lib-ios-openid4vci-swift

Implementation of OpenID for Verifiable Credential Issuance protocol (wallet's role) in Swift
Apache License 2.0
6 stars 7 forks source link

Special characters in `AuthorizationService` form POST request bodies are not encoded correctly #55

Closed srosenda closed 2 weeks ago

srosenda commented 1 month ago

The underlying utility class FormPost fails to encode special characters in the body correctly when using content type application/x-www-form-urlencoded according to https://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.

The issue was found when testing the library against the Finnish EUDIWallet backend, which defines a scope "pid.vc+sd-jwt" in its credential issuer metadata. FormPost failed to percent-encode the '+' character and it did not convert the space character that was delimiting the scopes to '+' as it should in application/x-www-form-urlencoded.

Fix to the special character encoding and related improvements in PR #54.