full pass at DID URL dereferencing algorithm (isolated)#344
Conversation
| that property. For example, the | ||
| <code>linkedResourceMetadata</code> property uses its own | ||
| handling strategy as described in the <a | ||
| href="https://w3c-ccg.github.io/did-linked-resources">DID |
There was a problem hiding this comment.
Should we reference this as an example? I can see the value of it, but as it is not a formal spec, perhaps we can't?
| <code>linkedResourceMetadata</code> property uses its own | ||
| handling strategy as described in the <a | ||
| href="https://w3c-ccg.github.io/did-linked-resources">DID | ||
| Linked Resource</a> specification. If the did document |
There was a problem hiding this comment.
| Linked Resource</a> specification. If the did document | |
| Linked Resource</a> specification. If the DID document |
| The group is currently debating how to handle DID Query | ||
| parameters during dereferencing. It is likely that query parameters | ||
| will be included as a legacy fallback for any query Parameters | ||
| that may affect dereferencing, in the same manner that document | ||
| properties, metadata, and method-specific strategies are supported. |
There was a problem hiding this comment.
I like this call out that we still need to figure this out. But the notion of legacy fallback feels weird to me.
Query parameters are a point of extension, this is like saying all extensions are treated as legacy fallbacks isn't it.
E.g. if I define the query parameter linkedResource which works like service but for the Linked Resource property, I would hope that is would be processed first (or at least after service if that is present)
| <code><pre>RetrievalUrl = https://example.com/didimages/image.png</pre></code> | ||
| </li> | ||
| <li> | ||
| <strong>Retrieve URL</strong> Perform an HTTPS GET operation |
There was a problem hiding this comment.
I like that you have defined a default handler strategy. But I am unsure about defaulting to HTTPS GET.
Why not just return the service endpoint and let the client figure it out?
E.g. if it is a BTCR2Beacon with a bitcoin: service endpoint, this is going to fail until a handler strategy is defined.
I am sure there are other similar cases.
Also, what about the case where a serviceEndpoint is a Map?
There was a problem hiding this comment.
Agree that this should not be constrained to HTTPS but should be based on the protocol defined by the serviceEndpoint.
| When invoking this handler, simply return the DID Document retrieved | ||
| from Resolve. | ||
| </p> | ||
| </section> |
There was a problem hiding this comment.
I think you are missing a closing , but probably best to check on your local.
The TOCs are all messed up from section 6. https://pr-preview.s3.amazonaws.com/LegReq/did-resolution/pull/344.html#dereferencing-provisional
|
Thanks @jandrieu for this. I think this is a great effort to define the DID URL Dereferencing algorithm. It is clear and easy to read and I think captures most of what the group has been discussing over the last few weeks. Interested to see how it lands for others. However, I do still stand by the strategy of focusing the groups attention on getting into CR with DID URL Dereferencing marked as at risk. That means:
I think we could be ready to do this in the next week or two. Then, when in CR we can turn our attention back to this PR and ironing out the last few pieces for the DID URL Dereferencing algorithm. Once complete and horizontal reviewed, we can create a new CR snapshot. We can discuss on the call this week, but the route I outlined feels like the safer option. |
Co-authored-by: Will Abramson <wip.abramson@gmail.com>
|
The section nesting seems to be messed up somehow.. 
|
| continue processing if the response provided enough | ||
| information to do so.</li> | ||
| <li> | ||
| <strong>Repeat</strong> as necessary until the final |
There was a problem hiding this comment.
I don't find this guidance particularly clear and question if it should be here at all. I gather from previous conversations that this is something about did:btcr2 (and therefore, perhaps other DID Methods), but am not sure, nor do I understand that use case. I definitely don't understand this "repeating" in the context of "point in time" DID Docs. versionTime is the known way to ask for a point in time DIDDoc, and how that is accomplished is DID Method specific, and so need not surface here. I can also imagine cases where a caller invoking DID URL dereferencing gets a results and decides to dereferencing another DID URL, but IMHO, that would be a separate invocation, not a "repeat as necessary".
I suggest that either a concrete example of what this means be added so it is clear why/when this might be needed, or we remove this.
There was a problem hiding this comment.
I agree with @swcurran . While I understand the intention of this (cases like did:btcr2 that sometimes require additional input), the language will be very confusing for non-experts and could lead to problematic implementations.
| a [[local resolver]], which does not (likely a local | ||
| resolver will be | ||
| invoked using standard linked library or interprocess | ||
| communication). Implementers MUST enable users to choose the |
There was a problem hiding this comment.
I'm not sure about what the last line ("Implementers MUST...") means and why it is needed. Does that mean an Implementer MUST offer multiple "did:web" resolvers (to pick one at random -- although perhaps blockchain-based DID methods might have different resolvers...) that the a caller to the implementation can choose? If so, what mechanism is suggested for that choice? If not selecting from multiple resolvers for the same DID Method, the DID in the DID URL being dereferenced specifies the DID method. Is that not sufficient, given that the caller invoked the DID URL dereferencer?
I propose this be expanded to make it clear why this is relevant or remove it.
| <li> | ||
| <strong>PathHandler Typed Properties</strong> | ||
| <p> | ||
| If the DID document, DID Document Metadata, or DID Resolution |
There was a problem hiding this comment.
The "IF" should include that a Path segment be present in the DID URL for any PathHandler properties be considered in this way. For example, a DID URL being dereferenced that is a bare DID with no parameters and no path should not care about the presence or not of PathHandling properties.
The same change is needed in the flowchart.
| <li> | ||
| <strong>Document Properties</strong> | ||
| <p> | ||
| If the DID document contains any properties known to affect |
There was a problem hiding this comment.
Less obvious, but with a similar argument from my last comment, I don't think that the mere presence of a property in a DIDDoc or DID Metadata should automatically trigger an impact on DID URL Dereferencing without some sort of trigger in the DID URL. Using the same example as my last comment, if I have DID URL that is bare DID that I'm dereferencing, the fact that there is a DID Linked Resource in the DID Metadata should not impact the result of just returning the DIDDoc.
This does raise the question of serves as a trigger? For path-like things (e.g. Linked Resources, DID Linked Resources, Path services), the path is an obvious. Extension parameters comparable to service are likewise useful triggers.
There was a problem hiding this comment.
Yes, I think this is a good point.
A DID URL that is just a DID without any other trigger, but with a DID document containing properties known to affect dereferencing should IMO dereference to the DID document.
| </p> | ||
| <ol> | ||
| <li> | ||
| <strong>Services</strong> |
There was a problem hiding this comment.
I think there is a need somewhere in the algorithm for extensions that define a property that is process in the same way that service is used. serviceType is being demoted to an extension AFAIK, but it is the obvious example. Where do you see in the overall algorithm does it gets processed? Likewise I can envision someone wanting to have a linkedResources parameter that is used to identify a specific linked resource in a DID Doc.
How much any of these parameters will be used in practice (including service) is an open question, but I struggle with seeing service being a wholly unique instance of a parameter vs. a member of a category of parameters that might be defined in the future in the spec or (more likely) as extensions.
| <li> | ||
| <strong>Select Service Endpoint</strong> Pick one of the | ||
| service's | ||
| <code>serviceEndppoint</code> values. Implementations SHOULD use |
There was a problem hiding this comment.
I think having this be normative is too high a bar for implementations. This forces implementations to be stateful, which (AFAIK) they don't otherwise need to be -- remembering the order that they picked each time they process this particular DID URL (assuming it hasn't been updated over time). My preference is that any statement on this be non-normative. If we do want to be normative, then I suggest that we say that end point be chosen at random.
| <code><pre>RetrievalPath = /didimages/image.png</pre></code> | ||
| </li> | ||
| <li> | ||
| <strong>Construct Retrieval URLs</strong> Replace the path part |
There was a problem hiding this comment.
I think this should reference the RFC 3986 processing. First because there is a lot of nuance of "replacing the path part...", and second and most importantly, implementers will almost certainly use URL handling libraries (e.g. Python's https://docs.python.org/3/library/urllib.html) that implement RFC 3986 handling. Likewise if there is a WhatWG URL reference, that could be used as well -- as I recall we have a To Do for that.
| <section id="pathHandler-path-matching-algorithm-provisional"> | ||
| <h2>PathHandler Path Matching Algorithm</h2> | ||
| <p> | ||
| When a DID Document contains one or more objects with a type of |
There was a problem hiding this comment.
Per earlier comment -- "When a DID Document contains and path and one or more..."
| <section id="return-did-document-dereferencing-algorithm-provisional"> | ||
| <h2>Return DID Document Handling Strategy</h2> | ||
| <p> | ||
| When invoking this handler, simply return the DID Document retrieved |
There was a problem hiding this comment.
There are extensions currently defined that I think (although arguable) are intended to be processed at this time. Notably:
- signedIetfJsonPatch (or perhaps at DID Resolution time?)
- transformKeys
Should there be a place for extensions to impact the resulting DIDDoc at this point in the algorithm?
|
A comment about the ReSpec style of this PR. In the majority of the document, we've used the style of tags being indented to their appropriate level, and the text being left justified starting in column 1 (or column 0 if you think that way...). This PR should be updated at some point to match that formatting. Given the comments that are now associated with line numbers I suspect it is too late now for that, but it should be done as soon as the PR is merged. |
|
One other thing to mention from my various closed PRs. In the one that was only about adding a standard way for DID URL Path Handling, a part of the PR added the "PathService" service type to the specification, defining how that works. This PR does not include that. The request from (at least a part of) the Working Group was to standardize as much of the path handling in the DID Resolution spec as possible. As such, I think we should be considering adding that into either this PR or a follow on. |
|
This was discussed during the #did meeting on 08 July 2026. View the transcriptw3c/did-resolution#344Will Abramson: So it's issue 3, 4, I mean, PR 3, 4, 4, sorry... Joe Andrieu: Yeah, I would just… I would just review the comments. I don't… I… Don't have a better way to go through it... Will Abramson: Good. Uh, excuse me... Otto Mora: Yeah. Yeah, I got you... Will Abramson: Yeah, so this is… let me look at the preview, um... Manu Sporny: I've glanced at it briefly, but have not had a chance to look at it in detail... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): I have definitely not reviewed it, but that's not a blocker... Will Abramson: Yeah, well, that's fine, but I wonder if maybe it is worth, you know, you just sort of walking through the steps. I mean, I can have a go, but you probably know a bit more intimately than me... Joe Andrieu: Uh, through the content? Yeah, I could walk… yeah, we could do that. Um... Will Abramson: It's here, right? Section 365. Oh, it's actually the whole... Joe Andrieu: Well, go ahead and go up to the first one because those are also edits. Um... Will Abramson: Yeah, so this will have to be updated, right, to be just a DID, I think... Joe Andrieu: Correct. Based on current, like, right, so these have all been things that have happened since IPR. Um, I'll also have to pull in the at-risk markers, right? So there's… there are some just logistical edits that... Will Abramson: Yep, great... Joe Andrieu: happy to get changes to make that clearer if the language is unclear, but I just wanted to speak to the question Steven had, um, even though he's not here, we'll... Will Abramson: Uh… Or maybe I can... Joe Andrieu: I put those in for you, Ted. Uh, you had mentioned how useful that is, and I don't disagree as a requirements guy. I'm like, hey, I've got tools that could make that... Will Abramson: This one, uh, this one, this one. Uh... Joe Andrieu: So that's the easy one This is the more complicated one but, there is an effort to try and give a visual explanation of what I'm about to walk through... Will Abramson: Well, maybe I can... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Yeah, I appreciate the effort. I'm just looking at these quickly and noticing contrast definitely needs to be checked with the tool. I'm pretty sure that the top two colors will want white text if they're going to stay those colors. The other thing is these seem to have colors... Joe Andrieu: They only indicate for the eye to follow that line... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Okay... Joe Andrieu: There's no semantic difference... Will Abramson: Yep... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): We don't have to hammer on that right now. It's just a thing to have in mind... Joe Andrieu: Yep, I appreciate that... Will Abramson: I mean, is it worth going over the algorithm through this diagram, or do you want to go back to the text?... Joe Andrieu: Sure. This may be easier. So first of all... Will Abramson: Is it a good time? I have a question, but maybe we'll let you go through it all. I don't know what's best... Joe Andrieu: By all means... Will Abramson: Yeah, so my question is really… I think it was Steven that raised this in the issues, um… in the comments, rather, and he's saying… so say we go… like, we just… we have a DID URL, but really that DID URL is just a DID, right? We're starting this DID URL... Joe Andrieu: Yep... Will Abramson: uh, like, contains this… a service, for example, with a path handler type. What… what should happen?... Joe Andrieu: Um, so there is a path handler. You would use a path handler, path matching algorithm... Will Abramson: Okay... Joe Andrieu: To continue, and if that path handler object has a handler strategy. Um, then you would use that... Will Abramson: Yep. Right, but if there isn't a match... Joe Andrieu: Um... Will Abramson: Yeah, so, I mean, in this case, it would be effectively if you don't manage to identify a path handler. Um... Joe Andrieu: Right. And that may be the right strategy for all of them. So maybe it's raise error and then go to use default document strategy. Maybe that's a better… Strategy... Will Abramson: uh... Joe Andrieu: Right now, I'm thinking it is better, like, because what else do you do? You raise an error, and then you end, and then you got... Will Abramson: Yeah... Joe Andrieu: um... Will Abramson: Yeah, I agree, actually, because you're gonna have a DID document when you get here, aren't you. So, yeah... Joe Andrieu: Right... Will Abramson: Uh, the other question... Joe Andrieu: So if you fail any of the fancy dereferencing, I think it probably is appropriate. I want to think through that from a security perspective or unexpected consequences, but it feels right on first blush to me... Will Abramson: Yeah, the other question I had is this path handling matching? Is… is this… like, say, like… is this, like, the… this is the largest path, right? So, like, say if I… I am just this slash path... Joe Andrieu: If, if you had, um... Will Abramson: It's interesting... Joe Andrieu: Uh, a URL with a slash as the path, and you had a service operative slash service? Um, in the current algorithm, that would match... Will Abramson: Great, thanks... Joe Andrieu: Um, should it match at all, is a reasonable question. Um... Will Abramson: Hmm. Okay... Joe Andrieu: Um, are saying, hey, uh, this… this token is like a folder. And everything below this folder is accessible via this path service... Will Abramson: We'll have something to think through. um... Joe Andrieu: Okay... Will Abramson: Uh, Joe, just keep going, I guess... Otto Mora: Uh, I see Ted. I see Ted in the queue... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Oh, that was old... Joe Andrieu: Okay... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Sorry... Otto Mora: I don't know if it was… that was… oh, okay... Joe Andrieu: So those are the two sort of advocated strategies. I want to be clear that the rest is all fallback. Um... Will Abramson: And just to clarify, multiple affecting properties would be like, I have a DID document with, like, linked resources as a property, and linked objects as a property, right? Like, two separate named properties that... Joe Andrieu: That's right. And so, you know, if we think about did linked resources and linked resources... Will Abramson: Right, because at the moment, this is kind of having a hierarchy, a little bit... Joe Andrieu: I guess edit... Will Abramson: Yep... Joe Andrieu: But I don't... Otto Mora: Mm-hmm... Joe Andrieu: Uh... Otto Mora: I do see Manuel on the queue... Joe Andrieu: But I'm curious if people agree that we want to elevate the document properties above metadata document properties. Or should we revise this to put those together? Because they're basically both the same. Um, you know… You've got some properties. Um… do we have multiple properties? Then either use the handler if we have a single property, or we use… or we do an error... Manu Sporny: Yeah, just because you asked for an opinion, Joe. It does feel like... Will Abramson: Yeah, that's interesting... Manu Sporny: the DID method specific handling strategy might need to take, at least to me, gut says it's more important than the metadata-based one, but I could easily see someone, you know, arguing the opposite... Joe Andrieu: Oh, interesting. The blue one that I haven't gotten to yet, you think should go before... Manu Sporny: Yeah, because, I mean, like, it feels like metadata is just stuffing the handling strategy into the kind of, like, you know, deepest, darkest hole in all the choices... <ottomorac> +1 to the diagram being very helpful Manu Sporny: Um, but I can see how someone would be like, but no, that's exactly, you know, where it should go, and that's, you know, and, you know, we did that so it doesn't get in the way of anything else. I don't know, there's so many different ways that, you know, this could be done. Um can't you make it simpler? Um… Just some thoughts. That's it Joe Andrieu: Let me ask Amanda, you suggested maybe putting the DID method, which is the last one we didn't quite get to, before the green one. Um, yeah... Manu Sporny: Don't know if I understood the question. My gut says yes, uh, for the question you asked, but I'm afraid I'm misinterpreting the question you're asking. Yes, ma'am... Joe Andrieu: You know, going from the more concrete to the more abstract... Manu Sporny: Mm-hmm, yes... Joe Andrieu: Um... Manu Sporny: Mm-hmm, yes... Joe Andrieu: Um, so that's… that's how I came up with the hierarchy. I was just looking for feedback to… to check bi... Manu Sporny: Yeah, I mean, I feel like, you know, if someone explicitly puts something in the DID document, or they explicitly choose a DID method, a specific DID method, they're expecting... Joe Andrieu: Yeah, it does make sense. So a principle of visibility here as a rubric to sort of evaluate. What should we look at first?... Manu Sporny: That's right, and individual choice, meaning, like, I picked this… me, the human, picked this DID method… may have picked this DID method because I really liked the way it worked, and I have said something very explicit about what I want to happen... wouldn't… You know, like that Joe Andrieu: Yeah. Interesting. I I agree. So I like that change... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Yeah, um... Joe Andrieu: One note of that, Manu. Sorry, I heard you, Ted, but I wasn't quite done. The, uh... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Uh, yeah, I don't... Joe Andrieu: How's the queue? Do we have anyone on the que... Otto Mora: I see, man. Man. I got Manu after that... Will Abramson: Thank you, Matt... Manu Sporny: Yeah, I don't agree with that, Ted. I do understand, I think, the philosophy that goes into that, you know, which I can see, right?... Joe Andrieu: Um, yeah, my take is largely the same as what you just said, Manu. Is it interop, then be... Otto Mora: Uh, Joe... Joe Andrieu: Makes us starting with, uh… if we put the DID method bit first. then... Otto Mora: Uh, Will?... Joe Andrieu: that that is the method handler for all DID checked, uh, DID URLs... Will Abramson: Uh, yeah, I just wanted to say, like, I completely… I mean, I guess tear hat on off, but I completely agree with what Joe and Manu just said, right? Like, the point… we're talking about the client here who has executed resolution. Like, resolution... Otto Mora: Uh, Steven?... Stephen Curran: Um, the only thing I, you know, I've said this a couple of times in the past, and I'm concerned about it, I think that... Otto Mora: Joe?... Joe Andrieu: So I think there's a misinterpretation somewhere, Steven. I don't know if we're talking past each other or one or other of us has misunderstanding. But to my analysis of this flow with the linked resources, if there's no path handler, no service, right? So we fall through to the green, check the metadata... <ottomorac> q> Stephen Curran: Okay, if you're comfortable that that couldn't get you there, that's fine. That's what I was raising. If you're comfortable with that, that's fine... Will Abramson: Um... Joe Andrieu: Cool, yeah, I... Will Abramson: Um, because, right, you have a DID document when you go in here. But anyway, I just wanted to update you on that. I see Joe on the queue, but then I think we can close, uh, and we'll revisit this. Yeah, Joe... Joe Andrieu: I just had a quick question for Steven, because it came up as we were walking through the algorithm... Stephen Curran: I couldn't understand that from that description. Sorry. Yes. Okay... Will Abramson: We can revisit tomorrow. I think it's fine, right?... Joe Andrieu: Yeah, that's… that's fine. I appreciate it. It was a little too confusing to try and get across in 30 seconds... Will Abramson: Yeah, so maybe tomorrow, you know, we're going to focus on getting to CRR, then if we have time, we'll revisit this, maybe we can just sort of reorient ourselves in this diagram, and then look at the actual text and the comments against the text, and try and process some of them, make some decisions. Great. Thank you, everybody. See you tomorrow... Joe Andrieu: Cool. Thanks... Otto Mora: Perfect. Thank you... |
|
Here is a try at concise description of the “infinite loop” question I raised re: Method Specific dereferencing. Not a big concern, but I thought an example might be worth sharing to see if triggers anything with others in the group. A DID Linked Resource example from DIDDoc Metadata from a live DID available via the Universal Resolver. This is the basis of the following examples: "linkedResourceMetadata": [
{
"resourceURI": "did:cheqd:testnet:55dbc8bf-fba3-4117-855c-1e0dc1d3bb47/resources/398cee0a-efac-4643-9f4c-74c48c72a14b",
"resourceCollectionId": "55dbc8bf-fba3-4117-855c-1e0dc1d3bb47",
"resourceId": "398cee0a-efac-4643-9f4c-74c48c72a14b",
"resourceName": "Eventbrite Logo",
"resourceType": "image/png",
"mediaType": "image/svg+xml",Example 1: Suppose this DIDDoc metadata is from a did:web DID (as the DID Linked Resources spec describes), and the resourceURI is an HTTP URL.
Example 2: The metadata is again from a did:web DID, and the resourceURI as it is in the example.
Example 3: Now the metdata is from a did:cheqd DID and the resourceURI as it is in the example.
My reason for raising this is that is to ask, does saying “it’s handled by the handler” work in all cases of a DID URL being the only identifier for a given resource? I don’t have another example to investigate to this level, so while my sense is that we do need an explicit “DID Method exception” at some point in the algorithm, I’m OK without it. I completely agree that if we do put it into the algorithm, we want a caveat that says — “DON’T USE THIS UNLESS YOU HAVE TO”. |
|
This was discussed during the #did meeting on 09 July 2026. View the transcriptw3c/did-resolution#344Will Abramson: So this is 344, which I'll subtopic, and I think it was great yesterday we kind of oriented ourselves on the diagram that Joe has in this PR. Maybe, Otto, would you mind sharing that again? And we can start from there... Otto Mora: Yeah, that's a great idea to. Yeah... Will Abramson: Uh, because I think there's definitely a lot more people on the call today, so maybe it would be good just to kind of skate over that again, and then we can dive into any of the comments that either folks have from the discussion or, uh, that are already in this, uh, as comments. Yeah, I think if you… no, no, I think if your file's changed, you just want to open, uh, this one. Yeah, just open it at the... Otto Mora: This guy here. Yeah, absolutely. Yeah, this is a very useful diagram, I agree. And also we should credit Ted for suggesting it, which I think makes a lot of sense... Will Abramson: Yeah. And, uh, so... Joe Andrieu: Um, sure. Um, I was taking a quick note of the highlights of what seemed to be some suggested changes tomorrow... Will Abramson: Yeah, thanks, Joe. And just quickly to jump in, if anyone has comments throughout this, just jump on the queue, and I guess we can take them as we go, Joe... Joe Andrieu: Yeah, that'd be great... Will Abramson: And I see Steven on the queue. Steven?... Stephen Curran: Yeah, so this comes back to my comment about... Will Abramson: Yeah, go for it... Joe Andrieu: Yeah My understanding was that we agreed that we we didn't have a clear use case, for service type being passed in here... Stephen Curran: Thank you... Joe Andrieu: and that we were just going to use an identical service property. Because one of the things that happens with service type is depending on how you get back out of it. You you lose some context. So I believe we talked about that maybe a month ago. And so this is... Will Abramson: I put myself on the queue. I mean, I think this is an interesting one, and I kind of am more aligned with Steven here. I mean, you know, uh... not in this flow, but the question is whether they should be Stephen Curran: Yeah, pretty much the same point. It's just that the problem is that there's nowhere anymore in the algorithm that would allow for those, which means extensions now become impossible because there's no place for them... Will Abramson: Thanks. Joe?... Joe Andrieu: Yeah, I agree. If we want to support queries, I think we should... Stephen Curran: could exist if someone proposed it as an extension. Will gave another one... Joe Andrieu: one of the challenges… my position is we should recommend that people don't do that, um, but of course people are going to do it, and we have a decentralized system. So, the question for me would be, in this flow... Stephen Curran: system, but now we're not gonna use it. That's… that's the concern... Joe Andrieu: Where would we handle the fallback to query? Because I do still feel that if you have a service query, I want that to dominate. I think that is a clear and unmitigatable signal. And I think it's important and useful that we do that... Will Abramson: Yeah, thanks. I mean, that is the thing, it's very… it's a… it's a complex, because it's this open-ended system that we're trying to, like, leave space for, and, you know, maybe that is… well, that's certainly part of the challenge. I think, you know, to your point, like... Stephen Curran: Thank you... Will Abramson: like, I don't know if it's separate from the path handling… path matching algorithm, but just like service, would… would potentially allow me to select a path handler in the service while ignoring a path… a path handler. that it's in a linked resource or in a did document property... <Zakim> JoeAndrieu, you wanted to say the client can always do crazy things. what we're talking about a standard way to figure out the dereferencing intention of the DID URL Author and DID Controller Will Abramson: you know, this isn't working because X, Y, and Z… yeah. I… I don't… I don't have good skin in the game, to say, so… Ciao Joe Andrieu: Yeah, um... <ottomorac> +1 lets revisit once we get feedback from DID method authors Joe Andrieu: I wanted to say that… Did you Will Abramson: I think I can see it, yeah. Right... Joe Andrieu: Yeah. Right. So the client can always ignore this flow. I mean, that's just reality. If someone's writing a client and they don't want to go through the algorithm, then fine. There's literally no way we can make them... vector, it could be whatever Will Abramson: Thanks, Steven... Joe Andrieu: Um, what we're… what I was trying to do with this was have a rigorous flow that let there be a deterministic, understandable outcome that's consistent for everyone who wants to play a conformant dereferencing game. And people want to customize their thing, they can be non-standard... Stephen Curran: Um, I… I agree that it's kind of arbitrary. It is somewhat… there's arguments all over of where to put it. I just want to see it put somewhere, so I would say… you know... Will Abramson: Thanks... Stephen Curran: Yes... Joe Andrieu: Cool. I'll do that in an x-ray. I've got to update this and then, you know, we'll get more feedback... Stephen Curran: Yep... Will Abramson: Yeah, I had a last suggestion, which is maybe slightly separate, or, like, different, is maybe we don't put it, like, concretely in this algorithm, but we just have, like, we could capture it in a note, and we could leave it to the extension to... Joe Andrieu: Yeah, I really don't agree, Will. I think having the client make up the algorithm is us not defining the algorithm. If we don't tell them that this is where you should check to see if there are any query parameters you understand, then they might check them first... Will Abramson: Okay. Fine, cool... Joe Andrieu: They might check them last, and that may create a disconnect between what the DID controller was expecting, or what the DID URL author was expecting... Yeah, I'll take a stab and get some feedback. Okay, shall I continue? Is there anyone else in the queue? Will Abramson: Yes, I think so. Nope... Joe Andrieu: I don't think so. Okay. Um, okay, so that was about, um... Will Abramson: Uh, maybe I have a quick question on that. Like, what do we, uh… what did we imagine? So, like, set handler strategy end, like, what comes out of this end that would then flow into the next... Joe Andrieu: So that's that top flow when a service query parameter is in the DID URL... Will Abramson: Um… by the execution... Joe Andrieu: Okay... Will Abramson: Right... Joe Andrieu: Sure. Oh, that… The… the next execution is invoke the handler... Will Abramson: Okay... Joe Andrieu: Um, um... Will Abramson: Yeah, and the handle strategy would say what it needs, right? Like, it'd say, like, I need the… I mean, or is it just going to always get the DID document and the DID resolution result and that sort of thing? Right... Joe Andrieu: Uh, well, it depends on the handler. Like, the strategy… is, um... Will Abramson: Okay... Joe Andrieu: in this flow, talking about what library we're using. We're just talking about figuring out which... Will Abramson: Yeah, that makes sense to me. I see the queue. Steven?... Stephen Curran: I would slightly… I would say it has access to everything that has been collected to this point... Joe Andrieu: Yep... Stephen Curran: And… and that can be important, because things like… you don't… you want to make sure that it has access to the path, if there's a path in it. So if you pick a service type... Will Abramson: Uh, okay, uh… I don't know if you want to respond, Joe, but otherwise I'll go to Ot... Joe Andrieu: Oh, I just think it's up to the library. If… if… if you're passing it off to a library… I mean, I agree with… with the… the... Will Abramson: Uh, Otto?... Joe Andrieu: But a given library may pick and choose what parameters you want to send to it. And you would have to know that when you read the documentation for the library when you integrate it into your code base... Otto Mora: Yeah, my thing is, it's a minor, Nate. I think it occurred to me as you were asking a question, like, what does the end state here mean, right? To a naive reader, just an external person that is not as familiar with this, maybe just for readability, like, you could say end, and then, like, a little, like... Joe Andrieu: So, could you... Otto Mora: You know, invoke chosen handler, like, little wording here, would... Joe Andrieu: Whoever's controlling the screen, if you could put up the other diagram?... Otto Mora: Oh, yeah... Joe Andrieu: This is one step in another diagram... Otto Mora: Okay, yeah, yeah. So this other one here?... Joe Andrieu: Right... Otto Mora: Using handovers. Uh-huh... Will Abramson: Yep... Joe Andrieu: And so, when you're done with that, you go to 4... Otto Mora: Invoke handler. OK. OK, so that'll be there for even before the other diagram gets shown, right? This in the reading continuum, this is first, and then this other diagram is shown later. Is that right? Okay... Joe Andrieu: Correct. If you look at the… I don't know if anyone has a preview of that PR. The immediately preceding section has that outline... Otto Mora: Okay... Joe Andrieu: Um, if you go up a little bit further... Will Abramson: That's not me, it's Satya... Otto Mora: Yeah... Will Abramson: uh... Joe Andrieu: Well a little bit more because we have the first two So that image is here in figure four and it's it's again in text Here are the here are the five steps or six steps whatever it is... Otto Mora: Got it, got it... Will Abramson: So just a comment, maybe instead of end, it could be continue? I don't know. I don't mind that, it's fine for me, though... Otto Mora: Or go to step three or four or five, whatever. I don't know. Could be. Either way... Joe Andrieu: Could be next step, maybe... Otto Mora: Yeah... Joe Andrieu: My concern with the linguistics of that is it, or the semantics of it, it feels like that's saying... Otto Mora: Uh-huh, uh-huh. Right... Will Abramson: Okay, cool... Joe Andrieu: Okay. Uh, it's an interesting question. Let me… let's… if… if you still have that concern when we get the next revin, um… Let's talk about it some more... Otto Mora: Yeah, either. That's really awesome. Yep. No, no, it's good that this is here, though. I I wasn't that wasn't in my radar. So that's good. Yeah. Mm-hmm... Joe Andrieu: Okay, so that was service. So the next one is really our preferred way for folks to use it in my sense, which is check to see if there's a path handler, which is... sort of entangle the 3986. Um, complexities, um Will Abramson: I'll see when it's on cue... Stephen Curran: One second, Joe. One second, Joe. The bigger one I'm concerned, I have to look at the details of what you got again to quite get what, but this, the condition here should be, is there a path? And a cop handler. Um... Joe Andrieu: Yep. I think I think you're right. Unless someone else chimes in, I I think that's a clean update. So it should be, um, is there a service query? No. Is there a path? If there's a yes, is there a path handler?... Stephen Curran: Yeah, exactly. Yep... Joe Andrieu: Okay... Stephen Curran: Or or just in that same box that that both conditions have to apply... Joe Andrieu: The path handler algorithm could handle having the default. So if we want to figure that out, I think we can... Stephen Curran: Yeah, concern would be… the concern would be if you… if you have a DID URL that is a bare DID... Joe Andrieu: Right. No, I'm actually… I meant to probe on a slightly different side of it, which is, if we have a path, but no path handler... Stephen Curran: Okay... Joe Andrieu: Is there something intelligent that we can do? I'm not sure that there is. Um... Stephen Curran: I don't think there is. Yeah, I don't think there is... Will Abramson: Yeah, uh, I guess I'll put myself on the queue, but I was gonna, uh, say, if it has a path and no path handler, then I think you fall through to these fallback options, and some of those fallback options, if you understand them, might still have path matching in play, right?... Stephen Curran: Right. Yes... Joe Andrieu: Yes, that is… that is correct... Stephen Curran: Yeah... Joe Andrieu: Um, and that's where a linked resource that's, you know, of the way that Sean Conway's deployed today. That's where that would get caught... Will Abramson: Mmhm... Joe Andrieu: Um, okay, so I think we were there on path handling, path matching, algorithm... Will Abramson: That's right. Thanks, Joe. I see Stephen. Yeah... Stephen Curran: Yeah, so I added a comment on this one that there still needs to be some sort of trigger... Joe Andrieu: So we set the handler and we're done... Stephen Curran: Um, for... Joe Andrieu: See Steven on the queue?... Stephen Curran: why you would go use one of the objects or an object in there. You can't. It can't just be its existence is good enough to take this path... Will Abramson: Yeah, thanks, Stephen. Joe?... Joe Andrieu: So, um, I would oppose that quite a bit, um, Steven. I think that this is deployed in the field. We have these properties. They are in our extensions registry. And, uh... Stephen Curran: No, no, I'm not saying that... Will Abramson: Yep... Stephen Curran: All right. Okay. Yep... Joe Andrieu: And so the distinction at literally at this, hold on, hold on, hold on, Steven. At this stage in the algorithm, you have already checked the service query. You've checked the pathfinder... Will Abramson: So... Joe Andrieu: Right. So this is for the case where the URL doesn't have anything in it. That's the point of this line in the algorithm... Will Abramson: So, I'm on the queue, and I just wanted... Stephen Curran: But if I have… oh, yeah, go ahead, sir. Yep... Will Abramson: Sorry, Sarah, I just wanted to add, uh... <Zakim> JoeAndrieu, you wanted to say that does work Will Abramson: Uh, I could not do that, but, I mean, maybe there are good use cases, but… uh… Joe Joe Andrieu: Yeah, so that's interesting. Actually, that speaks to… Um… Another thing I forgot that we had talked about. So, the, um... Will Abramson: Um, yeah, thanks, Joe... it's been a great <swcurran> All of the things that I've raised are in comments. Joe Andrieu: Yeah, well, comments in the issue are great. That's a good anchor for me. I will try to address all of them incorporating what we've talked about here in terms of, you know, what's a consensus resolution of some of the different ones in there. Some of them we haven't talked about, which is fine. Um... |
Co-authored-by: Manu Sporny <msporny@digitalbazaar.com>
Co-authored-by: Manu Sporny <msporny@digitalbazaar.com>
Co-authored-by: Manu Sporny <msporny@digitalbazaar.com>
Co-authored-by: Manu Sporny <msporny@digitalbazaar.com>
Co-authored-by: Manu Sporny <msporny@digitalbazaar.com>
Co-authored-by: Manu Sporny <msporny@digitalbazaar.com>
peacekeeper
left a comment
peacekeeper
left a comment
There was a problem hiding this comment.
-1 to sending path and/or fragment to the resolver, for reasons that have been discussed many times now.
-1 to performing an HTTPS GET on a service endpoint as part of the DID URL deferencing algorithm. This can lead to DoS attacks ("fetch this 100 GB file") and makes some existing use cases impossible, such as redirecting to a service endpoint as part of the HTTPS binding (see #306 (comment)).
-1 to not processing "relativeRef" when handling the "service" parameter.
I think I'm also -0.5 at this point to the whole "path handling objects" idea. This has taken hundreds of comments and many hours of discussion, and it still keeps changing. E.g. I don't really understand how example https://pr-preview.s3.amazonaws.com/LegReq/did-resolution/pull/344.html#example-16 would be processed by a dereferencer. I understand the desire of having a universal path handling framework, but all the proposal I have seen so far feel limiting to me. Keep in mind that things like "PathHandler", "PathService", "linkedResources" can also all be perfectly specified in extensions.
| <p> | ||
| The Working Group is currently exploring this new | ||
| DID URL Dereferencing algorithm, which has a more modular | ||
| approach than the previous one, based on or "handling strategies". |
There was a problem hiding this comment.
| approach than the previous one, based on or "handling strategies". | |
| approach than the previous one, based on our "handling strategies". |
|
This was discussed during the #did meeting on 16 July 2026. View the transcriptw3c/did-resolution#344Otto Mora: That would, effectively put us in CR. Oh, sorry Joe Andrieu: Yeah... Otto Mora: Yeah. Sorry. So the other topic, yes... Joe Andrieu: Yeah, so I believe I got that change in, so I believe it's propagated, but we should check it... Otto Mora: I know that Joe has provided some updates on this one, and then there was another... Joe Andrieu: And someone look at the preview... Otto Mora: comment here, uh, most recently from... Joe Andrieu: Um, but I updated my branch, which is the source of the PR, and that should update and go through. And I just… I just removed that extra bit about, you know, this is likely to be replaced by, or whatever. Um, so, just at risk for that section... Otto Mora: Uh, yeah, go ahead, Sean... Joe Andrieu: Um... Otto Mora: That sounds fair. Yeah, if you wanna... Joe Andrieu: uh... Otto Mora: You just take, like, the last, uh, 10-15 minutes to... Will Abramson: Yeah, no, that was what I was just gonna say. Let's do that... Otto Mora: Look at that... Joe Andrieu: Um, which is, I have an updated document, um, and the updated document should be in the PR. It doesn't preview well, because PR preview doesn't deal with… with local files like that. Um, but I'm… I'm ready to share it if we want to go through the algorithm... Will Abramson: Okay... Otto Mora: Uh, yeah, that as well, uh, I see Will... Will Abramson: Let me check... Otto Mora: Okay, okay. Which... Joe Andrieu: And I have I have not updated the text. Because I didn't wanna do that for a third time given that if we have changes to this diagram the check text is gonna have to be updated quite a bit. And my intention is... Otto Mora: Oh, okay, okay. So we will. We… Did the one marking it at risk. I mean, essentially, that's what the proposal said... <Wip> https://www.w3.org/2026/07/09-did-minutes.html#52bd Joe Andrieu: Because we've been addressing them in the discussion about the algorithm. I just, given that the algorithm's in flux, there were too many things to potentially go and check off. So that was the order I was planning on doing it is, if we can get some blessing on the diagram, then I'll rewrite the prose for the description of the algorithm... Will Abramson: Yep... Otto Mora: Mm-hmm... Joe Andrieu: Okay, did we want to get this other PR?... Otto Mora: Okay... Joe Andrieu: Accepted... Will Abramson: Yeah, maybe you can draft something, Otto. I just wanted… I just shared the link to the resolution that we did pass, which was publish the DID resolution specification as a candidate recommendation once PR346 has been merged... Joe Andrieu: Because I think we need a formal proposal for that... Will Abramson: I think that... Otto Mora: Oh, okay, okay, okay. So, if you just give me… go ahead, yeah... Joe Andrieu: To go to CR, I think. That's my understanding... Otto Mora: One's 3, 4, 6. Yes... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Sorry, what's up... Will Abramson: What's wrong?... Joe Andrieu: Um, the thing we voted on before was the intention to go to CR, but we didn't have specific spec text. In fact, we have now changed it. So what… technically, what we approved before, um, didn't have a… a formal instantiation for people to have… That's why I think we need a resolution for this particular transition document. Oh. I just… I just did it wrong... Will Abramson: Mm-hmm, mm... Joe Andrieu: The, um... Otto Mora: Like this index.html on the root... Joe Andrieu: My understanding was that in the transitions folder you put all the files needed for that spec to be moved into or be finalized and locked into place... Otto Mora: There... Joe Andrieu: If that makes any sense. Like, there's now a transitions folder, transitions 2026, CR. That has an index dot HTML, and the other file assets that are needed to render that. Um... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): Yeah, just so it's said, I don't have a clue on this. I have not handled the transition in... Otto Mora: It's probably our best shot, unless somebody else has any ideas... TallTed // Ted (he/him) Thibodeau Jr (OpenLinkSw.com): A bunch of years... Joe Andrieu: Ah... Otto Mora: Mm-hmm... Stephen Curran: I think you've gotta update both, right? You need, uh... Joe Andrieu: But the… the root folder is not updated. Like… Correct. And so what I… the error I just made is I tried to do this quick change for the at-risk stuff... Stephen Curran: Which is going to use the index.html as source... Joe Andrieu: Um, and I think I am, but I don't know if anyone has more experience with this... Stephen Curran: I think… I'm assuming that's the process. I don't know any of the details, I don't know how you created it. I highlighted that. the file in the snapshot is double the size of the index.html, and I assume that's because of… there's some process you ran on it to create it. Is that right?... Joe Andrieu: Manu has left already, and I think I would make him answer the question. Sure. OK. Fair enough. Thanks. Um... Otto Mora: Oh... Joe Andrieu: However, if I go and update the correct document, then I think, we would all be good... Stephen Curran: Right. Okay... Joe Andrieu: Um… Um, that is probably correct. The process, I think, that did that is the export. So... Stephen Curran: See, so this is the tricky part, is you've got to get that into the index.html so that you can then do the export, right? Which is why I'm not sure you can do it all in one… in one PR... Joe Andrieu: You, in github.io, whenever you have that respec little pill up in the right-hand corner, um, you can click on that, and you export, and it does some pre-processing of the live rendered page... Stephen Curran: Okay. Hmm. Okay... Joe Andrieu: Um, and then I think it's an editorial matter to update. what's in root to reflect what the snapshot was... Otto Mora: Okay... Joe Andrieu: Yes, but look at crindex.html, and it doesn't have it yet. Yes. My understanding is that snapshot in the transitions... Will Abramson: Mm-hmm... Joe Andrieu: is what the CR is... Will Abramson: Yeah, I guess I put myself on the queue to say, like, I mean... Otto Mora: At least that's my interpretation of this. Oh, the sub... Joe Andrieu: The rest is still our working repo. Index.html is our working repository. The snapshot is saying this is what we are asking to go into CR... Will Abramson: It feels like the more normal way is, like, you don't edit, you shouldn't be hand-editing these files in the transition folder at all, and they should just be a snapshot of a published. Back... Otto Mora: Ahhh… Yes. Mm-hmm. Yes... Will Abramson: I know this is, uh… a hack, and maybe it's fine, but I don't know if it's some processes, right, that… We might be not understanding and messing up in the process... Otto Mora: Oh... Joe Andrieu: Okay. For my part in this quagmire, that is part of the conversation today. I did just update what is now in the transitions index dot HTML... Otto Mora: Go ahead... Will Abramson: Oh, yeah, I think that was from before, actually, but I do have a comment, which is just… so, just to ask... Joe Andrieu: Um, and then we… you and me, Steven, I'll… I mean, I'll do it realistically, but the editors can now take it as an editorial to update, um, the repos. Uh, to match the snapshot... Will Abramson: Do we think there is a proposal that we should pass that is transitioned to VR, to CR? I'm pointing out this. tax... Joe Andrieu: Which would include updating the version and some other things. Um, but I am still worried about the Echidna stuff as well... Otto Mora: That's it. 3, 4, 8... Joe Andrieu: Uh, so I'll follow up with, um, PA about that... Will Abramson: 58348... Otto Mora: Okay... Joe Andrieu: I see you did jump on the queue, Will... Otto Mora: Okay, so... Joe Andrieu: Yes. Yeah, I think that would be good to do... Otto Mora: Yeah, include the one too... Joe Andrieu: Uh, I just drafted something real quick, and I moded it. Um... Otto Mora: Personally... <ottomorac> Proposal: Accept PR#348 and advance the snapshot in /transitions/2026/CR to candidate recommendation Otto Mora: Uh, okay. So <Wip> +1 <JoeAndrieu> +1 <markus_sabadello> +1 <JennieM> +1 <swcurran> +1 Otto Mora: Okay <TallTed> +1 <smccown> +1 RESOLUTION: Accept PR#348 and advance the snapshot in /transitions/2026/CR to candidate recommendation Otto Mora: Yep, that's it. Well, everybody voted plus one Joe Andrieu: Yeah, I think that would be good. The diagram hasn't incorporated everything that I believe we've talked about. Of course, I may have missed some stuff, so I'm welcome to, you know, but I think doing a deep dive in the subtopic call And then hopefully, you know, we can just finalize it on Friday... Otto Mora: incorporate some of the other aspects, and maybe perhaps even during the work, the special topic, I was thinking, will we dive into that diagram... Joe Andrieu: And then I'll… I'll put the pros together, um, and get a draft update of that as my last task before, um... Otto Mora: ah. Just more at our own time... Will Abramson: Mm-hmm... Otto Mora: Actually already spec and potentially puzzle resolution algorithm. Cool... Joe Andrieu: Uh… I leave for my travel. I think that's how the timing's gonna end up. Many prosperous and healthful years for you and yours well... Will Abramson: Yeah, I put myself on the queue, actually, to say, uh, maybe in the interest of, like, you know, we're moving to CR, and we want to have a... Joe Andrieu: Well, I… I think… I think it actually explains to someone who's concerned about what are the… why are there 2D referencing sections? Um... Otto Mora: Mm-hmm. Mm-hmm... Stephen Curran: I did a path. I didn't label them. I didn't label them. What I did was I did a path to the issues... Otto Mora: Uh-huh... Stephen Curran: Um, and I can't… and I will update the labels on them. Uh, concern I had was... Otto Mora: Right. Um, I mean, we could probably... Stephen Curran: Does anyone know the W3C, the W3C rules on those, or is it just totally up to the working group, but we can do what we want?... Otto Mora: Will's the right person for that. Go ahead, Will... Will Abramson: Yeah, I don't know, uh, and it would be good to talk to PA, because I know a lot of those labels are just inherited from the W3C, and, like, they have some that do have specific meanings... Stephen Curran: Hmm. Okay... Will Abramson: uh, people who are going to review us, so, like, that's partly why there's so many. But, you know, if there are ones that you think really should be removed, we can have a conversation, and we can ask the PA as well. Hopefully... Otto Mora: Mm-hmm. Down... Joe Andrieu: Yeah. Just just to comment... Otto Mora: That's fine... Stephen Curran: I did close, uh, I did close 11 of them, um, that I think were, uh, for, for good reason, um, obviously all with comments so that people can see they've been closed and can reopen them if it's appropriate... Joe Andrieu: Um... Otto Mora: Oh, that's… that's commentary, Joe. Okay... Joe Andrieu: Yeah, I just want to say I'm pretty certain that the repo we can do whatever we want with. I don't think these labels are part of process. I've never seen anything in the W3C process saying you have to do anything with any particular repo in any particular way... Otto Mora: Okay... <ottomorac> transcriber-bot, pause |
* created CR transition files` ` * updated version, changed status to CR, updated editors list * updated version in html as well as config * add a use of verification method to fix respec warning * fixed css style element to avoid respec warning * Update at risk section in index.html Removed reference to replacement content from the DID Resolution Threat Model. * Refactor at-risk section text for clarity Removed redundant phrase in the at-risk section description.
Co-authored-by: Will Abramson <wip.abramson@gmail.com>
…id-resolution into feature/dereferencing-algorithm
…id-resolution into feature/dereferencing-algorithm
7 participants
Per our last working group call (that I was on). Here's a proposed top-level dereferencing algorithm with flow chart illustration.
Preview | Diff