openid / OpenID4VP

49 stars 18 forks source link

What is effective client_id in unsigned browser requests? #213

Open jogu opened 1 month ago

jogu commented 1 month ago

The browser API appendix says:

The client_id and client_id_scheme MUST be omitted in unsigned requests defined in (#unsigned_request). The Wallet determines the Client Identifier from the origin as asserted by the Web Platform and/or app platform.

I'm not clear if "determines" here means "client_id is the origin". If it's not we need to say what we do mean as the the verifier needs to know what value it needs to check for in aud in the response.

jogu commented 1 month ago

In the unsigned request section it says:

In this case, the Wallet will use the Verifier's origin as asserted by the Browser as the Verifer's Client Identifier

So I think we just need to update the language in the "determines" clause to make it more direct.