Skip to content

fix: use credentialIssuer?.credentialIssuerIdentifier rather than iss as source for issuer metadata fetching - #418

Merged
smncd merged 2 commits into
release/sirosidfrom
fix/dont-use-iss-to-fetch-issuer-metadata
Oct 29, 2026
Merged

fix: use credentialIssuer?.credentialIssuerIdentifier rather than iss as source for issuer metadata fetching#418
smncd merged 2 commits into
release/sirosidfrom
fix/dont-use-iss-to-fetch-issuer-metadata

Conversation

@smncd

@smncd smncd commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

This was a problem because iss was not necessarily matching the issuer URL (such as trailing slash vs no trailing slash)

This surfaced after sirosfoundation/go-wallet-backend#495 was merged, where we're stricted about trailing slashes.

I also refactored getIssuerMetadata() to take a single argument with all options, rather than many arguments, for easier readability.

This fix is needed to pass OpenID Conformance test suite

Type of change

  • Bug fix
  • Feature
  • Refactor
  • Performance
  • Documentation
  • Tests
  • Build/CI
  • Chore

Related issues / tickets

Checklist

  • I self-reviewed my changes
  • I added/updated tests (or explained why not)
  • I updated documentation (if needed)
  • I ran the relevant checks locally (lint/unit/integration)
  • I verified backward compatibility / migration notes (if needed)
  • I added monitoring/logging (if needed)

Security checklist

  • No secrets, credentials, or API keys are hardcoded
  • New dependencies have been reviewed for known vulnerabilities
  • User input is validated and sanitized where applicable
  • No new attack surface introduced without security review
  • PII/sensitive data handling follows data protection policies
  • N/A — this PR does not affect code, deps, or configuration

@smncd
fix: use credentialIssuer?.credentialIssuerIdentifier rather than …
69de2be 
…`iss` as source for issuer metadata fetching

This was a problem because `iss` was not necessarily matching the issuer URL (such as trailing slash vs no trailing slash)
@smncd
smncd requested a review from a team as a code owner October 29, 2026 14:13
@changeset-bot

changeset-bot Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 6fa70bc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
wallet-common Patch
wallet-frontend Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@smncd
docs(changeset): use credentialIssuer?.credentialIssuerIdentifier …
6fa70bc 
…rather than `iss` as source for issuer metadata fetching
@smncd
smncd requested review from leifj and s-jairl October 29, 2026 14:14
@sonarqubecloud

sonarqubecloud Bot commented Oct 29, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
40.9% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

@smncd
smncd merged commit d248701 into release/sirosid Oct 29, 2026
12 of 13 checks passed
@smncd
smncd deleted the fix/dont-use-iss-to-fetch-issuer-metadata branch October 29, 2026 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leifj leifj leifj approved these changes
@s-jairl s-jairl Awaiting requested review from s-jairl

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@smncd @leifj