Issues

• token_detail.html: Validate Claims requires typ "at+JWT" and fails RFC 9068's "at+jwt"

  bug
  rcbj/id-proto-debugger#385 · Filter by author rcbjBlueMars opened on Oct 25, 2026
  1

• Each promotion deploys test.idptools.com twice and runs its live suite twice

  rcbj/id-proto-debugger#384 · Filter by author rcbjBlueMars opened on Oct 24, 2026
  1

• DID Tools job: did:web fixtures after iya-sts removed /did/generate

  rcbj/id-proto-debugger#366 · Filter by author rcbjBlueMars opened on Oct 23, 2026

• OID4VCI use cases: make the cross-device and deferred (pre-authorized) offers work with any issuer, not iya-sts's demonstration pages

  rcbj/id-proto-debugger#365 · Filter by author rcbjBlueMars opened on Oct 23, 2026

• OID4VP: the presentation workflow plays the Verifier instead of the Wallet

  rcbj/id-proto-debugger#364 · Filter by author rcbjBlueMars opened on Oct 23, 2026

• SSF: the api hosts a Shared Signals transmitter on the page's behalf, so iya-sts can receive CAEP and RISC from the debugger

  rcbj/id-proto-debugger#363 · Filter by author rcbjBlueMars opened on Oct 23, 2026

• sts_persistence_postgres.js: replace the retired saml2.entityId realm override (iya-sts #523)

  rcbj/id-proto-debugger#358 · Filter by author rcbjBlueMars opened on Oct 8, 2026

• tests/sts_applications.js authorizationCode() cannot sign in to a product-mode iya-sts: risk scoring refuses node's default User-Agent

  rcbj/id-proto-debugger#356 · Filter by author rcbjBlueMars opened on Oct 6, 2026

• sts_applications.js: accept a masked credential (iya-sts #446 masks every credential in GET answers)

  rcbj/id-proto-debugger#354 · Filter by author rcbjBlueMars opened on Oct 6, 2026

• sts_saml11.js: resolve a relying party's artifact at its own responder; unresolved artifacts are the empty response (iya-sts#160)

  rcbj/id-proto-debugger#353 · Filter by author rcbjBlueMars opened on Oct 5, 2026
  1

• sts_saml11.js: resolve the artifact at the relying party's own responder, and expect Success with no assertion for a replay (iya-sts#160)

  rcbj/id-proto-debugger#352 · Filter by author rcbjBlueMars opened on Oct 5, 2026

• Upgrade @noble/curves: 1.4.0 cannot write or read a P-521 ECDSA signature in DER

  rcbj/id-proto-debugger#351 · Filter by author rcbjBlueMars opened on Oct 5, 2026
  1

• Client crypto modules: move jws.js, pk_encryption.js and symmetric_crypto.js from node-forge to WebCrypto

  rcbj/id-proto-debugger#350 · Filter by author rcbjBlueMars opened on Oct 3, 2026

• sts_applications.js: read iya-sts client-secret records, not strings

  bug
  rcbj/id-proto-debugger#339 · Filter by author rcbjBlueMars opened on Oct 2, 2026

• Token and refresh request previews drop <client_secret> from the Basic header

  bug
  rcbj/id-proto-debugger#337 · Filter by author rcbjBlueMars opened on Oct 2, 2026

• Batch the nine open Dependabot bumps into develop

  dependencies
  rcbj/id-proto-debugger#336 · Filter by author rcbjBlueMars opened on Oct 2, 2026

• OpenID4VCI wallet helper asks for openid it doesn't need; iya-sts product mode now refuses it

  rcbj/id-proto-debugger#327 · Filter by author rcbjBlueMars opened on Oct 1, 2026

• Kerberos codecs: eight catches keep no trace of the error they caught (found by iya-sts#355)

  rcbj/id-proto-debugger#322 · Filter by author rcbjBlueMars opened on Sep 30, 2026

• KDC: a message-router seam on the TCP/UDP 88 listeners, so iya-sts cells can answer at home

  rcbj/id-proto-debugger#317 · Filter by author rcbjBlueMars opened on Sep 28, 2026

• Post-quantum JWE key establishment: ML-KEM (pqc-kem-05) and HPKE incl. X-Wing, to interoperate with iya-sts #82

  rcbj/id-proto-debugger#312 · Filter by author rcbjBlueMars opened on Sep 27, 2026

• SSF page hand-off asks for ssf:read ssf:write, which webapp1 does not declare (invalid_scope since iya-sts #110)

  rcbj/id-proto-debugger#311 · Filter by author rcbjBlueMars opened on Sep 27, 2026

• PKI page: profile keyUsage defaults ignore the key algorithm (non-conformant ML-DSA, SLH-DSA, EdDSA, EC certificates)

  rcbj/id-proto-debugger#310 · Filter by author rcbjBlueMars opened on Sep 27, 2026

• OAuth2/OIDC page seeds the token request's scope with every scopes_supported value

  rcbj/id-proto-debugger#309 · Filter by author rcbjBlueMars opened on Sep 27, 2026

• krb5 codec: decGeneralString decodes a KerberosString as Latin-1 while encGeneralString writes UTF-8

  rcbj/id-proto-debugger#308 · Filter by author rcbjBlueMars opened on Sep 26, 2026

• From iya-sts #189-#192: sts_saml11.js accepts Shibboleth's SAML 1.1 attribute names; DoNotCacheCondition; the artifact choice in the binding menu

  rcbj/id-proto-debugger#307 · Filter by author rcbjBlueMars opened on Sep 26, 2026