Closed zacknewman closed 3 weeks ago
2024-05-15 WG call:
OpenID Connect also forbids empty strings as claim values in an attempt to preempt some interop problems. There, https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse says:
If a Claim is not returned, that Claim Name SHOULD be omitted from the JSON object representing the Claims; it SHOULD NOT be present with a null or empty string value.
We should do likewise.
The enforcement rule for the Nickname Profile in RFC 8266 expressly forbids empty strings:
This seems to contradict the recommendation for RPs to set
PublicKeyCredentialUserEntity.displayName
to the empty string when "no suitable or human-palatable name is available" while simultaneously recommending RPs and clients enforce the rule:Should the spec be changed to state rule enforcement SHOULD only occur when
displayName
is not empty? I was personally bit by this omission in the RP library I am writing.