iss in examples should start with https

Issue #1021 resolved
Takahiko Kawasaki created an issue

The description of iss in "2. ID Token" in "OpenID Connect Core 1.0" says as follows:

REQUIRED. Issuer Identifier for the Issuer of the response. The iss value is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components.

According to this description, the value of iss claim should start with https:. However, iss values in examples in OIDC Core 1.0 (e.g. "A.2. Example using response_type=id_token") start with http:.

Examples should be modified.

Comments (3)

  1. Log in to comment