Skip to content

Contradicting use of response_uri parameter #666

@beusink

Description

@beusink

Section 8.2 states that response_uri is REQUIRED when the Response Mode direct_post is used.

Section 5.9.3 contradicts this:
"redirect_uri: This prefix value indicates that the original Client Identifier part (without the prefix redirect_uri:) is the Verifier's Redirect URI (or Response URI when Response Mode direct_post is used). The Verifier MAY omit the redirect_uri Authorization Request parameter (or response_uri when Response Mode direct_post is used).

Suggest adjusting section 8.2 to reflect this exception.
Something along the lines of "REQUIRED when the Response Mode direct_post is used, unless combined with Client Identifier Prefix redirect_uri"

Alternatively given that B.2.6.1 states "The fourth element MUST be either the redirect_uri or response_uri request parameter, depending on which is present, as determined by the Response Mode."
and
"Unless otherwise stated, the values of client_id, nonce, redirect_uri, and response_uri request parameters referenced above MUST be obtained from the Authorization Request query parameters if the request is unsigned, or from the signed Request Object if the request is signed.",
removing the "MAY omit" sentence in section 5.9.3 might be a more appropriate remedy.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions