Security Considerations
Security is central to the Verifier’s design, ensuring trust and privacy throughout the verification process:
Transport Security: All communication occurs over HTTPS, safeguarding data in transit.
Nonce and State Parameters: Verification requests incorporate unique, time-bound values to prevent replay attacks.
Client Authentication: The
clientSecretauthenticates the relying party to the Verifier Service. Store it securely and never expose it client-side.Credential Integrity: The Verifier checks cryptographic signatures and DID Documents, rejecting credentials that fail authenticity or integrity checks.
Minimal Data Exposure: The Verifier only processes essential data. It does not store unnecessary information, preserving privacy.
Monitoring and Logging: Maintain logs and monitor for suspicious activities, such as repeated failed verifications.
Error Handling: Avoid exposing sensitive details in error responses. Provide generic user-facing messages and log technical details internally.
By following these security practices and integrating them into your application’s operations, you maintain a robust, trusted environment for all stakeholders.
Last updated