search

uport-project / ethr-did

Create ethr DIDs
Apache License 2.0
259 stars 53 forks source link

Does revokeDelegation also delete the past signed JWTs from that delegate? #37

Closed hsnhrn closed 4 years ago

hsnhrn commented 4 years ago

A user add some address as a delegate. This delegate then signs a JWT on behalf of this user. Now after 1 week if user revoked this delegate, the signed delegate doesn't get verified using verifyJWT() function. Is it a normal behaviour? Is there something like if a user revoked a delegate then the JWT this delegate signed, should not be verified after revoking the delegate but past JWT should get verified?

mirceanis commented 4 years ago

This is normal behavior.

In most cases, it is up to the verifier to decide the rules by which a JWT is considered valid. The current implementation does not allow a clock skew when resolving the did document so the revoked delegate would not appear as valid. This functionality will most likely never be part of the official verifier since the security implications are too wide to consider. Using an upcoming version of did-jwt, which should make its way into this repo soon, you will be free to use a customized resolver/verifier that would answer questions like "was valid at time".

mirceanis commented 4 years ago

I believe this was answered so I'm closing it. Please submit a new issue or reopen if that is the case.