Basic, Messages - Why can't an Issuer Identifier have a path component?

[Michael Jones]

Basic and Messages define "Issuer Identifier" as "A verifiable identifier of an Issuer. An issuer Identifier is a HTTPS URL with no path component."

Nowhere do we say why it can't have a path component. We should either say why it can't or allow it.

[Nat Sakimura]

It was a WG consensus.

If the issuer that is different from Javascript origin allows cross issuer scripting, which is not good.

[Nat Sakimura]

.well-known and SWD does not allow it.

Certificate is issued to host.

[Nat Sakimura]

Issue #325 was marked as a duplicate of this issue.

[Nat Sakimura]

Issue #331 was marked as a duplicate of this issue.

[John Bradley]

Simple Web Discovery only supports one endpoint per host.

Host is also what SSL certificates relate to.

Having more than one issuer per host greatly complicates things.

[John Bradley]

Fixes #322 add security concern re SWD being per host as one reason issuers are per host

→ 1c990c34f093