Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

/profile/card editing should be a valid WebID #1709

Open
bourgeoa opened this issue Nov 11, 2022 · 2 comments
Open

/profile/card editing should be a valid WebID #1709

bourgeoa opened this issue Nov 11, 2022 · 2 comments
Assignees

Comments

@bourgeoa
Copy link
Member

bourgeoa commented Nov 11, 2022

@jeff-zucker Do you have any hints to what minimal controls on a card WebID should contain ?
Are all the following needed

<./card> a foaf:PersonalProfileDocument; foaf:maker :me; foaf:primaryTopic :me.

:me
    a foaf:Person;
    solid:oidcIssuer <https://solidcommunity.net:8443>;
    solid:account </>;
    space:storage </>;
    foaf:name "bourgeoa-solidcommunity:8443".

I'm not sure the last 3 are a MUST.

@bourgeoa bourgeoa self-assigned this Nov 12, 2022
@timea-solid
Copy link
Contributor

We are waiting for some input from the WebID spec.

@jeff-zucker
Copy link
Member

The oidc:Issuer is required by the Solid-OIDC spec. Everything else is up in the air as to whether it will be a MUST in the coming spec. But at a minimum all the predicates you show will be strong recommendations (I hope). Regardless of whether they are a MUST, I do not see any advantage and multiple disadvantages to not including them in default profiles.

What I do see as a very critical issue is that we should disallow editing of the oidcIssuer. Make users request changes to it by email. A mistake in the oidcIssuer blocks the user from authenticating with their WebID. A bad actor replacement of the oidcIssuer would hijack the entire account.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants