Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New user/holder task - Receive and process claim request #140

Open
RieksJ opened this issue May 8, 2023 · 1 comment
Open

New user/holder task - Receive and process claim request #140

RieksJ opened this issue May 8, 2023 · 1 comment

Comments

@RieksJ
Copy link
Contributor

RieksJ commented May 8, 2023

Requirement: It MUST be possible for a holder to receive requests for one or more claims (from particular kinds of credentials), and
subsequently process such requests and create responses thereto.

Motivation: Since verifiers are expected to need different claims from different credentials from different issuers, and construct a request for that (#139), holders must be enabled to either retrieve claims that the verifier requests, but perhaps also to send a request to designated issuers to obtain claims/credentials if they are not yet available from the holder's credential repository.

@RieksJ RieksJ changed the title New user task - receive and process claim request New user/holder task - Receive and process claim request May 8, 2023
@jandrieu
Copy link
Collaborator

jandrieu commented Mar 1, 2024

@RieksJ This request option presents potential problems with regard to spam and DDOS. We can consistently expected VC flows to be initiated by the holder, so that the holder remains in control about which VCs are issued or shared. A requirement to receive requests could be construed to imply that requests can be from arbitrary verifiers and queued for a response from the holder. However, we almost certainly do not want wallets to expose an arbitrary public interface that any self-proclaimed verifier could use to submit spurious or malicious requests.

Perhaps:

Holders must be able to initiate a flow of interactions that enables verifiers to request specific types of credentials.

Importantly, this is not a requirement for a passive "inbox" but rather a way for a holder-initiated action to trigger a request that they can then respond to.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants