From 9ef9e724062fa612bfecdf5f7224eb7a8a02105b Mon Sep 17 00:00:00 2001 From: Paul Bastian Date: Fri, 10 Jul 2026 14:26:59 +0200 Subject: [PATCH 1/3] add back removal of any terminating `/` from the Credential Issuer Identifier when forming the Credential Issuer Metadata URL --- 1.0/openid-4-verifiable-credential-issuance-1_0.md | 7 ++++--- 1.1/openid-4-verifiable-credential-issuance-1_1.md | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/1.0/openid-4-verifiable-credential-issuance-1_0.md b/1.0/openid-4-verifiable-credential-issuance-1_0.md index 419a6b32..55dd80a1 100644 --- a/1.0/openid-4-verifiable-credential-issuance-1_0.md +++ b/1.0/openid-4-verifiable-credential-issuance-1_0.md @@ -1309,9 +1309,9 @@ A Credential Issuer is identified by a case sensitive URL using the `https` sche The Credential Issuer's configuration can be retrieved using the Credential Issuer Identifier. -Credential Issuers publishing metadata MUST make a JSON document available at the path formed by inserting the string `/.well-known/openid-credential-issuer` into the Credential Issuer Identifier between the host component and the path component, if any. +Credential Issuers publishing metadata MUST make a JSON document available at the path formed by inserting the string `/.well-known/openid-credential-issuer` into the Credential Issuer Identifier between the host component and the path component, if any. If the Credential Issuer Identifier contains a path component, any terminating `/` MUST be removed before inserting `/.well-known/openid-credential-issuer`. -For example, the metadata for the Credential Issuer Identifier `https://issuer.example.com/tenant` would be retrieved from `https://issuer.example.com/.well-known/openid-credential-issuer/tenant`. The metadata for the Credential Issuer Identifier `https://tenant.issuer.example.com` would be retrieved from `https://tenant.issuer.example.com/.well-known/openid-credential-issuer`. +For example, the metadata for the Credential Issuer Identifier `https://issuer.example.com/tenant` would be retrieved from `https://issuer.example.com/.well-known/openid-credential-issuer/tenant`. The metadata for the Credential Issuer Identifier `https://issuer.example.com/tenant/` would also be retrieved from `https://issuer.example.com/.well-known/openid-credential-issuer/tenant`. The metadata for the Credential Issuer Identifier `https://tenant.issuer.example.com` would be retrieved from `https://tenant.issuer.example.com/.well-known/openid-credential-issuer`. Communication with the Credential Issuer Metadata Endpoint MUST utilize TLS. @@ -1565,7 +1565,7 @@ One such use case is low assurance Credentials, such as coupons or tickets. Another use case is when the Credential Issuer uses cryptographic schemes that can provide binding to the End-User possessing that Credential without explicit cryptographic material being supplied by the application used by that End-User. For example, in the case of the BBS Signature Scheme, the issued Credential itself is a secret and only a derivation from the Credential is presented to the Verifier. Effectively, the Credential is bound to the Credential Issuer's signature on the Credential, which becomes a shared secret transferred from the Credential Issuer to the End-User. -If Cryptographic Key Binding is not required, the Credential Issuer omits the `cryptographic_binding_methods_supported` parameter in the `credential_configurations_supported` object in the Credential Issuer Metadata as defined in (#credential-issuer-parameters). As a consequence, the `proof_types_supported` parameter is also absent, indicating to the Wallet to omit the `proofs` parameter in the Credential Request. +If Cryptographic Key Binding is not required, the Credential Issuer omits the `cryptographic_binding_methods_supported` parameter in the `credential_configurations_supported` object in the Credential Issuer Metadata as defined in (#credential-issuer-parameters). As a consequence, the `proof_types_supported` parameter is also absent, indicating to the Wallet to omit the `proofs` parameter in the Credential Request. ## Multiple Accesses to the Credential Endpoint @@ -3040,6 +3040,7 @@ The technology described in this specification was made available from contribut -19 * Add security consideration on transaction code guessing + * add back removal of any terminating `/` from the Credential Issuer Identifier when forming the Credential Issuer Metadata URL -final diff --git a/1.1/openid-4-verifiable-credential-issuance-1_1.md b/1.1/openid-4-verifiable-credential-issuance-1_1.md index a0af675f..9580d1fe 100644 --- a/1.1/openid-4-verifiable-credential-issuance-1_1.md +++ b/1.1/openid-4-verifiable-credential-issuance-1_1.md @@ -1688,15 +1688,15 @@ The Credential Issuer Metadata contains information on the Credential Issuer's t ### Credential Issuer Identifier {#credential-issuer-identifier} -A Credential Issuer is identified by a case sensitive URL using the `https` scheme that contains scheme, host and, optionally, port number and path components, but no query or fragment components. +A Credential Issuer is identified by a case sensitive URL using the `https` scheme that contains scheme, host and, optionally, port number and path components, but no query or fragment components. ### Credential Issuer Metadata Retrieval {#credential-issuer-wellknown} The Credential Issuer's configuration can be retrieved using the Credential Issuer Identifier. -Credential Issuers publishing metadata MUST make a JSON document available at the path formed by inserting the string `/.well-known/openid-credential-issuer` into the Credential Issuer Identifier between the host component and the path component, if any. +Credential Issuers publishing metadata MUST make a JSON document available at the path formed by inserting the string `/.well-known/openid-credential-issuer` into the Credential Issuer Identifier between the host component and the path component, if any. If the Credential Issuer Identifier contains a path component, any terminating `/` MUST be removed before inserting `/.well-known/openid-credential-issuer`. -For example, the metadata for the Credential Issuer Identifier `https://issuer.example.com/tenant` would be retrieved from `https://issuer.example.com/.well-known/openid-credential-issuer/tenant`. The metadata for the Credential Issuer Identifier `https://tenant.issuer.example.com` would be retrieved from `https://tenant.issuer.example.com/.well-known/openid-credential-issuer`. +For example, the metadata for the Credential Issuer Identifier `https://issuer.example.com/tenant` would be retrieved from `https://issuer.example.com/.well-known/openid-credential-issuer/tenant`. The metadata for the Credential Issuer Identifier `https://issuer.example.com/tenant/` would also be retrieved from `https://issuer.example.com/.well-known/openid-credential-issuer/tenant`. The metadata for the Credential Issuer Identifier `https://tenant.issuer.example.com` would be retrieved from `https://tenant.issuer.example.com/.well-known/openid-credential-issuer`. Communication with the Credential Issuer Metadata Endpoint MUST utilize TLS. @@ -3722,3 +3722,4 @@ The technology described in this specification was made available from contribut * add iana registration for an openid foundation urn * add optional metadata to the credential response * use OAuth 2.0 for First-Party Applications as basis for Interactive Authorization + * add back removal of any terminating `/` from the Credential Issuer Identifier when forming the Credential Issuer Metadata URL From b9a93c72663b08d99c949281bcd041a6dfc25579 Mon Sep 17 00:00:00 2001 From: Paul Bastian Date: Fri, 31 Jul 2026 13:54:47 +0200 Subject: [PATCH 2/3] add recommendation that Credential Issuer Identifier should not terminate with `/` --- 1.1/openid-4-verifiable-credential-issuance-1_1.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-credential-issuance-1_1.md b/1.1/openid-4-verifiable-credential-issuance-1_1.md index a4df5cc7..751feb62 100644 --- a/1.1/openid-4-verifiable-credential-issuance-1_1.md +++ b/1.1/openid-4-verifiable-credential-issuance-1_1.md @@ -1688,7 +1688,7 @@ The Credential Issuer Metadata contains information on the Credential Issuer's t ### Credential Issuer Identifier {#credential-issuer-identifier} -A Credential Issuer is identified by a case sensitive URL using the `https` scheme that contains scheme, host and, optionally, port number and path components, but no query or fragment components. +A Credential Issuer is identified by a case sensitive URL using the `https` scheme that contains scheme, host and, optionally, port number and path components, but no query or fragment components. The Credential Issuer Identifier SHOULD not contain a terminating `/`. ### Credential Issuer Metadata Retrieval {#credential-issuer-wellknown} @@ -3722,5 +3722,6 @@ The technology described in this specification was made available from contribut * add iana registration for an openid foundation urn * add optional metadata to the credential response * use OAuth 2.0 for First-Party Applications as basis for Interactive Authorization + * add recommendation that Credential Issuer Identifier should not terminate with `/` * add back removal of any terminating `/` from the Credential Issuer Identifier when forming the Credential Issuer Metadata URL * update IA HTTP response codes for consistency with First-Party Application draft-4 From 4d9b9e81567596ae4f25646857cb0c117c245f85 Mon Sep 17 00:00:00 2001 From: Paul Bastian Date: Fri, 31 Jul 2026 13:54:47 +0200 Subject: [PATCH 3/3] add recommendation that Credential Issuer Identifier should not terminate with `/` --- 1.1/openid-4-verifiable-credential-issuance-1_1.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/1.1/openid-4-verifiable-credential-issuance-1_1.md b/1.1/openid-4-verifiable-credential-issuance-1_1.md index a4df5cc7..b160b9b5 100644 --- a/1.1/openid-4-verifiable-credential-issuance-1_1.md +++ b/1.1/openid-4-verifiable-credential-issuance-1_1.md @@ -1688,7 +1688,7 @@ The Credential Issuer Metadata contains information on the Credential Issuer's t ### Credential Issuer Identifier {#credential-issuer-identifier} -A Credential Issuer is identified by a case sensitive URL using the `https` scheme that contains scheme, host and, optionally, port number and path components, but no query or fragment components. +A Credential Issuer is identified by a case sensitive URL using the `https` scheme that contains scheme, host and, optionally, port number and path components, but no query or fragment components. The Credential Issuer Identifier SHOULD NOT contain a terminating `/`. ### Credential Issuer Metadata Retrieval {#credential-issuer-wellknown} @@ -3722,5 +3722,6 @@ The technology described in this specification was made available from contribut * add iana registration for an openid foundation urn * add optional metadata to the credential response * use OAuth 2.0 for First-Party Applications as basis for Interactive Authorization + * add recommendation that Credential Issuer Identifier should not terminate with `/` * add back removal of any terminating `/` from the Credential Issuer Identifier when forming the Credential Issuer Metadata URL * update IA HTTP response codes for consistency with First-Party Application draft-4