Closed JesusMcCloud closed 3 months ago
Hi @JesusMcCloud
Thanks for reporting this.
I believe that you must take into account that when using direct_post
or direct_post.jwt
there is not redirect_uri
. In addition the rules for redirect_uri
that you mention are applicable to the redirect_uri
in this case.
A while ago, I had opened a related issue to the specification (https://github.com/openid/OpenID4VP/issues/116), about improving the description of these rules. Please take a look to authors response.
Thank you very much for the explanation and the pointer! Everything's cleared up now.
The sample requests using
x509_san_dns
as identifier scheme are missing aredirect_url
.As per https://openid.net/specs/openid-4-verifiable-presentations-1_0.html:
The issue here is a violation of the very last requirement:
However, the request does not set
redirect_uri
. Hence, verification fails.Reporting this as a new issue, since, #79 is already closed.