Skip to content

Require HTTP GET binding and allow HTTP POST #192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: gh-pages
Choose a base branch
from
Open

Require HTTP GET binding and allow HTTP POST #192

Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d016020
add http get and post binding options
ottomorac Sep 12, 2025
0196966
Update index.html
ottomorac Sep 24, 2025
598c0d3
Update index.html
ottomorac Oct 1, 2025
7713382
Merge branch 'w3c:gh-pages' into ottomorac-add-http-method-binding
ottomorac Oct 1, 2025
b6d4dc7
Update index.html
ottomorac Oct 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2208,6 +2208,15 @@ <h2>HTTP(S) Binding</h2>
<p>This binding is generally considered a <a>remote binding</a>, but could
also be a <a>local binding</a> if the HTTP(S) endpoint is run in a local environment, such as on <code>localhost</code>.</p>

<p>All conformant <a>DID resolvers</a> MUST implement an HTTP(S) binding using GET as described in the algorithm below.
Copy link
Member

@msporny msporny Oct 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this duplicate text in PR #182: https://github.com/w3c/did-resolution/pull/182/files#diff-0eb547304658805aad788d320f10bf1f292797b5e6d745a3bf617584da017051R2298-R2299

... if so, we shouldn't repeat normative statements because edits to one of them are often missed in the other statement. It is a best practice to follow DRY principles with normative statements.

Copy link
Contributor Author

@ottomorac ottomorac Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok good observation @msporny. After some review, I think then we keep the normative text in this PR and then remove some of the redudant text in #182

In #182 I will keep the text about "All HTTPS bindings MUST use TLS".

@peacekeeper do you agree?

Copy link

@dlongley dlongley Oct 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's the "secure" language that is used in other W3C specs based on "secure contexts" (see: https://www.w3.org/TR/secure-contexts/) that might be able to be leveraged so we don't have to continue to make extra distinctions. This also provides "localhost" treatment.

In addition, <a>DID resolvers</a> MAY support an alternative HTTP(S) binding using POST.
Allowing clients to send POST request to the resolver endpoint may be useful in order to avoid URL length limitations,
and it also allows the DID (or DID URL) and resolution options to be kept out of the invoked URL
(protecting them from exposure in logs, proxies, or monitoring).
Finally, using POST also has the advantage that all data types of a <a href="#metadata-structure">metadata structure</a>
are fully supported, including <a data-cite="INFRA#maps">maps</a>, <a
data-cite="INFRA#list">lists</a>, and <a data-cite="INFRA#ordered-set">sets</a>.</p>

<p>Using this binding, the <a>DID resolution</a> function (see
<a href="#resolving"></a>) and/or <a>DID URL dereferencing</a> function (see <a href="#dereferencing"></a>)
can be executed as follows:</p>
Expand Down
Loading