5.1.2.2 External attachments: Require Content-Type header in the HTTP response

[Vladimir Dzhuvinov]

This is a suggestion to put it down in text that the endpoint must indicate the content type of the document. It may be obvious but better be explicit.

‌

url: REQUIRED. OAuth 2.0 resource endpoint from which the document can be retrieved. Providers MUST protect this endpoint. The endpoint URL MUST return the document whose cryptographic hash matches the value given in the digest element.

https://openid.bitbucket.io/eKYC-IDA/openid-connect-4-identity-assurance-1_0-master.html#section-5.1.2.2

This is a suggestion for a sentence at the end of the paragraph, borrowing text from the embedded attachment section:

“The content (MIME) type of the document MUST be indicated in a Content-Type HTTP response header. See [RFC6838]. Multipart or message media types are not allowed.“

‌

[Peter Bainbridge-Clayton]

This makes sense, to give an indication to the RP as to how to handle the document. Typical values would be:
application/pdf
image/tiff

etc. The authoritative list is held by IANA: https://www.iana.org/assignments/media-types/media-types.xhtml

[Mark Haine]

esolved by PR #107

[Mark Haine]

resolved by PR #107