Skip to content

Refine processing expected_origins and processing steps#719

Open
awoie wants to merge 10 commits intomainfrom
awoie/fix-224
Open

Refine processing expected_origins and processing steps#719
awoie wants to merge 10 commits intomainfrom
awoie/fix-224

Conversation

@awoie
Copy link
Copy Markdown
Contributor

@awoie awoie commented Apr 16, 2026 •
edited
Loading

Fixes #224

@awoie awoie mentioned this pull request Apr 16, 2026
Open
awoie
awoie commented Apr 16, 2026
View reviewed changes
Comment thread 1.0/openid-4-verifiable-presentations-1_0.md Outdated
awoie
awoie commented Apr 16, 2026
View reviewed changes
Comment thread 1.0/openid-4-verifiable-presentations-1_0.md Outdated
awoie
awoie commented Apr 16, 2026
View reviewed changes
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
awoie
awoie commented Apr 16, 2026
View reviewed changes
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
@awoie
Remove "opaque" as per DCG feedback
58b4527 
Co-authored-by: Oliver Terbu <o.terbu@gmail.com>
@awoie
Copy link
Copy Markdown
Contributor Author

awoie commented Apr 16, 2026

I removed the term "opaque" as per WG consensus.

@brentzundel brentzundel mentioned this pull request Apr 16, 2026
Open
@awoie awoie changed the title Clarify origin is an opaque string Refine processing expected_origins and processing steps Apr 16, 2026
awoie
awoie commented Apr 16, 2026
View reviewed changes
Comment thread 1.0/openid-4-verifiable-presentations-1_0.md Outdated
awoie
awoie commented Apr 16, 2026
View reviewed changes
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
@awoie
Refined wording
eb30c93 
Co-authored-by: Oliver Terbu <o.terbu@gmail.com>
fkj
fkj reviewed Apr 20, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@fkj fkj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the clarity could be improved by also adding text to note that an Origin can really be any string in the definition of Origin.

Comment thread 1.0/openid-4-verifiable-presentations-1_0.md Outdated
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Thirdly, cross-device requests benefit from the use of secure transports with proximity checks, which are handled by the OS platform, e.g., using FIDO CTAP 2.2 with hybrid transports.

And lastly, as part of the request, the Wallet is provided with information about the Verifier's Origin as authenticated by the user agent, which is important for phishing resistance.
And lastly, as part of the request, the Wallet is provided with information about the Verifier's Origin as authenticated by the trusted platform (e.g., user agent), which is important for phishing resistance.
Copy link
Copy Markdown
Member

@fkj fkj Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment as above regarding other trusted platforms than user agents.

Copy link
Copy Markdown
Contributor Author

@awoie awoie Apr 23, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see above

@Sakurann
Copy link
Copy Markdown
Collaborator

Sakurann commented Apr 22, 2026

APAC DCP WG discussion:

fkj
fkj reviewed Apr 22, 2026
View reviewed changes
Comment thread 1.0/openid-4-verifiable-presentations-1_0.md
Comment on lines 123 to 124
Origin:
: An identifier for the calling website or native application, asserted by the web or app platform. A web origin is the combination of a scheme/protocol, host, and port, with port being omitted when it matches the default port of the scheme. An app platform may use a linked web origin, or use a platform-specific URI for the app origin. For example, the Verifier for the organization MyExampleOrg is served from https://verify.example.com. The web origin is `https://verify.example.com` with `https` being the scheme, `verify.example.com` being the host, and the port is not explicitly included as `443` is the default port for the protocol `https`. The native applications origin on some platforms will also be `https://verify.example.com` and on other platforms, may be `platform:pkg-key-hash:Z4OFzVVSZrzTRa3eg79hUuHy12MVW0vzPDf4q4zaPs0`.
Copy link
Copy Markdown
Member

@fkj fkj Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Origin:
: An identifier for the calling website or native application, asserted by the web or app platform. The Origin MAY be any string, but will typically follow a platform-specific convention. A web origin is the combination of a scheme/protocol, host, and port, with port being omitted when it matches the default port of the scheme. An app platform may use a linked web origin, or use a platform-specific URI for the app origin. For example, the Verifier for the organization MyExampleOrg is served from https://verify.example.com. The web origin is `https://verify.example.com` with `https` being the scheme, `verify.example.com` being the host, and the port is not explicitly included as `443` is the default port for the protocol `https`. The native applications origin on some platforms will also be `https://verify.example.com` and on other platforms, may be `platform:pkg-key-hash:Z4OFzVVSZrzTRa3eg79hUuHy12MVW0vzPDf4q4zaPs0`.

Copy link
Copy Markdown
Contributor Author

@awoie awoie Apr 23, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fkj Just editorially, I would like to avoid having normative verbs in the terminology section for some reasons (e.g. defining test cases). Does the following work?

Suggested change
Origin:
: An identifier for the calling website or native application, asserted by the web or app platform. The Origin is any string, but will typically follow a platform-specific convention. A web origin is the combination of a scheme/protocol, host, and port, with port being omitted when it matches the default port of the scheme. An app platform may use a linked web origin, or use a platform-specific URI for the app origin. For example, the Verifier for the organization MyExampleOrg is served from https://verify.example.com. The web origin is `https://verify.example.com` with `https` being the scheme, `verify.example.com` being the host, and the port is not explicitly included as `443` is the default port for the protocol `https`. The native applications origin on some platforms will also be `https://verify.example.com` and on other platforms, may be `platform:pkg-key-hash:Z4OFzVVSZrzTRa3eg79hUuHy12MVW0vzPDf4q4zaPs0`.

Copy link
Copy Markdown
Member

@fkj fkj Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I have no strong opinion on the exact wording here.

@awoie @fkj
Applied Frederik's suggestion
71f8ed9 
Co-authored-by: Frederik Krogsdal Jacobsen <fkj@users.noreply.github.com>
awoie
awoie commented Apr 23, 2026
View reviewed changes
Comment thread 1.1/openid-4-verifiable-presentations-1_1.md Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fkj fkj fkj left review comments

@marcoscaceres marcoscaceres Awaiting requested review from marcoscaceres

@martijnharing martijnharing Awaiting requested review from martijnharing

@jogu jogu Awaiting requested review from jogu

@dpostnikov dpostnikov Awaiting requested review from dpostnikov

@c2bo c2bo Awaiting requested review from c2bo

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Clarifications on processing expected_origins and processing steps

3 participants

@awoie @Sakurann @fkj