OpenID4VP

OpenID4VP copied to clipboard

Direct post and Request URI POST request are both form encoded. It was suggested to instead use JSON encoded payload. Let's discuss.

I suggest using JSON for new APIs. To me Token Request uses form url-encoding due to legacy reasons, but we don't do the for credential request either, so I don't see a reason to do it for the POST request_uri

Would you suggest we change this for the direct post request, too?

That's a very good question. Direct post actually seems to just send the authorisation response over POST instead of GET, so mimicking send more reasonable.

In the case of request Uri, we are actually sending new data that is not defined in RFC9101, so deviating here seems more justified. This is also why I believe this is kind of a new command and I wouldn't call the parameter request_uri_method to indicate the support for it.

I wouldn't call the parameter request_uri_method to indicate the support for it.

Are you suggesting to rename request_uri_method parameter name? What's your alternative?

is the main motivation for this change aesthetics? Don't think this has come up as feedback from various interoperability event. this would be a big breaking change, pretty late in the specification lifecycle without a significant technical gain (from what i can tell, but i might be wrong). suggest we close this issue.

+1 to what Kristina said. I wouldn't break this now.

I would agree, especially as the DC API is all in JSON. Although I couldn't really find this as normative text in the spec. Are we missing something here?

Although I couldn't really find this as normative text in the spec. Are we missing something here?

if I understood you correctly, I think we wanted to leave definitions of how to express protocol requests to W3C specification?

I ask: where do we say that the content of DC API request is JSON encoded?

It was also suggested to not change this.

I would raise sustained opposition if we were to make this change.

I'm also in favour of not making this change.

there does not seem to be any support to make this change. closing in a week unless objections are raised.

I ask: where do we say that the content of DC API request is JSON encoded?

Somewhat late response, but we don't state this. DC API is not JSON encoded, it's a JavaScript object, that is defined by DC API spec

Then should we state this or is it obvious enough?