Struct StatusListCheck 

pub struct StatusListCheck<C, R, V = DefaultVerifier> { /* private fields */ }

Available on crate features did-web and status-list only.

A StatusCheck for the Token Status List: for the status claim of an SD-JWT credential or of a JWT credential (CredentialStatus::StatusClaim), fetches the status list token from the referenced URI with an HttpClient, verifies it was signed by the key its header names (KeyReference::from_jws with the token’s iss), resolved for KeyRole::Issuer, and reads the status at the referenced index (Token Status List §8).

When the token has an iss, the key must belong to it (KeyReference::binds_to); without one, only a key named by a DID URL is accepted, since a key by value or a key set could be anybody’s. Beyond that the check trusts the key the reference resolves to; whether that key may speak for the list is the application’s policy to enforce around it, by restricting the resolver, say.

Fetching

Every request asks for application/statuslist+jwt (StatusListToken::MEDIA_TYPE) through HttpClient::get_accepting. ReqwestClient (feature reqwest) also negotiates gzip, which the draft recommends Status Providers use.

A 301, 302, 303, 307 or 308 response is followed, as the draft recommends: its location is resolved against the URL that returned it and fetched with a new request through the same client, so that every hop passes the client’s checks. The check refuses a target that is not https, a URL already visited (a loop), a redirect without a Location, and more than MAX_REDIRECTS redirects.

The status list URI comes from the credential, and a redirect target from whoever serves it, so the client fetches whatever an issuer names: client must enforce the protections ReqwestClient does (HTTPS only, no redirects of its own, no non-public addresses after name resolution, a body limit and a timeout), or the status check becomes a request forgery primitive.

Implementations

impl<C, R, V> StatusListCheck<C, R, V>

pub const MAX_REDIRECTS: usize = 3

The most redirects one status list fetch follows.

impl<C: HttpClient, R: KeyResolver, V: JwsVerifier> StatusListCheck<C, R, V>

pub fn new(client: C, resolver: R, verifier: V) -> Self

A check fetching with client, resolving the status issuer’s key with resolver and verifying with verifier.

Trait Implementations

impl<C: Debug, R: Debug, V: Debug> Debug for StatusListCheck<C, R, V>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<C: HttpClient, R: KeyResolver, V: JwsVerifier> StatusCheck for StatusListCheck<C, R, V>

fn check<'life0, 'life1, 'async_trait>( &'life0 self, status: CredentialStatus<'life1>, now: DateTime<Utc>, ) -> Pin<Box<dyn Future<Output = Result<(), StatusError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Available on crate feature vc only.

Checks the Token Status List reference of a status claim; a credentialStatus entry, or a status claim without one, is StatusError::Unsupported.