Mike Bishop has entered the following ballot position for draft-ietf-oauth-sd-jwt-vc-24: No Objection
When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ for more information about how to handle DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- # IESG review of draft-ietf-oauth-sd-jwt-vc-24 CC @MikeBishop -24 was posted with the Updates: 7800 tag and fixes for most of my comments, so updating to track. Thanks for the quick turnaround. I know you disagree with the remaining comments, and they're non-blocking, but retaining them for the record. ## Comments ### Section 4.2, paragraph 1 ``` Metadata configuration as its content, using the application/json media type. The general requirements for HTTP retrieval defined in Section 3 apply. ``` While this is sufficient, I would encourage a distinct media type so that the server can assert the intended role of this JSON object. Same goes in 5.3.1. ### Section 4.3, paragraph 2 It might be worth explicitly stating that this applies regardless of any redirection chain that may have occurred -- if the JWT had an Issuer of one.example.com but redirected the query to two.example.com, the response still has to contain one.example.com to be valid, regardless of who served it. _______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
