Security Considerations
Security is paramount in the Issuer Service:
API Authentication and Authorization:
Client Secret: Sensitive operations (schema management, issuing offerings) require x-client-secret.
Bearer Tokens: Wallets use bearer tokens (obtained from authorization codes) to retrieve credentials.
Transport Security: Always use HTTPS to protect data in transit.
Credential Integrity: Credentials are cryptographically signed. Any tampering invalidates the signature.
Replay Attack Prevention: Authorization flows use state and nonce parameters. Replayed requests are rejected.
Access Controls and Monitoring: Consider IP whitelisting, firewalls, and audit logs to track suspicious activities. Implement rate limiting to prevent brute-force attempts.
Key Management: Keys are managed internally. Future enhancements will support key rotation, maintaining long-term security.
By following these measures, the Issuer Service maintains trust and integrity within the SSI ecosystem.
Last updated