Skip to content

Conversation

@coplat
Copy link
Contributor

@coplat coplat commented Jan 12, 2026

Description of change

This PR initializes the nonce endpoint as described in OID4CI's draft 15 specification. . This is vital as a means to prevent replay attacks during credential requests. Nonces are generated when a post request is made to the /oid4vci/nonce endpoint, returning a unique and fresh c_nonce.

This c_nonce must then be included in the proof of a CredentialRequest made to the issuer. If that nonce has already been redeemed or does not exist, the credential request is denied.

If it is valid, the c_nonce is then marked as redeemed and can no longer be reused.

This PR initializes the nonce endpoint which generates the nonce, and validates the nonce when a credential request is made within the API layer. Further, the nonce commands, events, errors and corresponding aggregate are also initialized within this PR.

Links to any relevant issues

How the change has been tested

Existing tests have been updated to include nonces. Nonce endpoint has been added to the postman collection for c_nonce generation.

Definition of Done checklist

Add an x to the boxes that are relevant to your changes.

  • I have followed the contribution guidelines for this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • I have successfully tested this change in a docker environment

@coplat coplat self-assigned this Jan 12, 2026
@coplat coplat marked this pull request as ready for review January 12, 2026 15:35
@coplat coplat added the Blocked Something blocks the integration of this code. label Jan 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Blocked Something blocks the integration of this code.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants