Merged
Conversation
- update dependencies with vulnerabilities - mock aligned in tests with the correct jwks structure
…ty-vulnerability Fix Private Key Exposure in JWKS
…dd protocol support recap to README - PAR endpoint: reject requests containing request_uri parameter per RFC 9126 - Add unit test for request_uri rejection - Add Protocol Support Recap section to README with checkboxes for: - OpenID4VCI: supported features and batch/deferred marked as not supported - OpenID4VP: supported features and transaction_data marked as not supported
When DPoP is required, include cnf.jkt (JWK thumbprint) in both access and refresh tokens to cryptographically bind them to the DPoP key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements:
It also brings the following ones:
Documentation and Protocol Support:
README.md.default_acr_valuein authorization configuration, emphasizing its role as an IdP fallback and not part of OpenID4VP.proof_jwt_requiredconfiguration option for credential endpoints, specifying its behavior and defaults.Configuration and Integration Test Updates:
proof_jwt_requiredflag inintegration_test/conf/openid4vci_frontend.yamlto control proof JWT requirements at the credential endpoint.scopesfield from backend configuration in test files, aligning with updated claim handling logic. [1] [2]securityconfiguration sections from backend test configs.Codebase Refactoring and Improvements:
BaseVPParserfrom internal SATOSA backend modules to a centralized location inpyeudiw.credential_presentation.base_vp_parserfor better modularity and testability. [1] [2] [3]MissingHandlerexception to a new dedicated module, improving error handling in DCQL parsing. [1] [2]vp_tokenandpresentation_submissionin authorization response parsing, focusing on DCQL flow requirements and improving robustness for varying input formats. [1] [2]GitHub Actions Workflow Enhancements:
security-audit.ymlworkflow to skip duplicate runs using thefkirc/skip-duplicate-actionsaction, reducing unnecessary CI runs.python-app.ymlandsecurity-audit.ymlworkflows. [1] [2]Documentation Acknowledgments:
Added M&Ms to the acknowledgments section in the
README.md.Updated the version number to
2.2.0inpyeudiw/__init__.py.