Closed Denisthemalice closed 9 months ago
Note that the meaning of claim name uniqueness refers to the fact that the "index" into the IANA registry at https://www.iana.org/assignments/jwt/jwt.xhtml is via the claim name. If there are two claims that have the same name then it would be difficult to find out which semantic was meant.
Your examples, "age_Over" and "age_Under" are different claim names. Hence, there is no problem.
If selective disclosure is being used, a digital credential might contain, for example, four claims
"age_Over"= "13" ,"age_Over"= "15", "age_Under"= "25" and "age_Under"= "30".
Depending upon the request from a Verifier, one or two of these attributes would be disclosed. For such attributes names, duplication should be allowed.
However, RFC 7519 (JWT) states:
The Claim Names within a JWT Claims Set MUST be unique;
If JSON is being used (without using JWT), then this becomes possible.
It should be noted that RFC 8392 (CWT) is rather different from RFC 7519 (JWT).
RFC 8392 (CWT) states:
RFC 7519 (JWT) states:
Such requirement does not exist in RFC 8392 (CWT).
When using selective disclosure, there are good reasons to allow duplication of some claim names, e.g. to handle claim names such as "nationality", "age_Over" or "age_Under".