search

openid / sharedsignals

OpenID Shared Signals Working Group Repository
45 stars 11 forks source link

Clarify expected response when "state" is incorrect for Verification event #171

Closed FragLegs closed 3 weeks ago

FragLegs commented 1 month ago

In section 7.1.4.1, the SSF spec says that if the Receiver requests a Verification event with a state value and the Transmitter sends an incorrect state in the subsequent Verification event, the Receiver should respond with "setData".

Upon receiving a Verification event, the Event Receiver SHALL parse the SET and validate its claims. In particular, the Event Receiver SHALL confirm that the value for "state" is as expected. If the value of "state" does not match, an error response of "setData" SHOULD be returned (see Section 2.3 of {{RFC8935}} or {{RFC8936}}).

It is unclear what is being referenced and how exactly the Receiver should respond. We should add further clarification.

tulshi commented 1 month ago

Define a new registry entry for section 7.1 of RFC8935 and include that in the IANA considerations of this spec.