Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add error handling section #389

Merged
merged 9 commits into from
Jun 18, 2024
57 changes: 57 additions & 0 deletions index.html
Original file line number Diff line number Diff line change
Expand Up @@ -1173,6 +1173,63 @@ <h4>Exchange Examples</h4>
</section>
</section>

<section>
<h3>Error Handling</h3>
<p>
Error handling and messaging in the VC-API follows [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457.html).
Implementers SHOULD include a [status](https://www.rfc-editor.org/rfc/rfc9457.html#name-status)
and a [title](https://www.rfc-editor.org/rfc/rfc9457.html#name-title)
in the error response body relating to the specifics of the endpoint on which the error occurs.
<p>
<p>
Aligning on error handling and messaging will greatly improve test-suites accuracy
when identifying technical friction impacting interoperability.
</p>
</p>
Leveraging other fields such as [detail](https://www.rfc-editor.org/rfc/rfc9457.html#name-detail),
[instance](https://www.rfc-editor.org/rfc/rfc9457.html#name-instance),
and [type](https://www.rfc-editor.org/rfc/rfc9457.html#name-type)
is encouraged, to provide more contextual feedback about the error,
while being conscious of security concerns and hence not disclosing
sensitive information.
</p>
<p>
Implementers should handle all server errors to the best of their capabilities.
Endpoints should avoid returning improperly handled 500 errors in production
environments, as these may lead to [information disclosure](https://owasp.org/www-community/Improper_Error_Handling).
</p>
<h4>Relationship between verification and error handling</h4>
<p>
An implementer should avoid raising errors while performing
[verification](https://w3c.github.io/vc-data-model/#verification),
and instead should gather
[ProblemDetails](https://w3c.github.io/vc-data-model/#problem-details)
objects to include in the verification results.
</p>
<h4>Types of ProblemDetails</h4>
<h5>[PARSING_ERROR](https://www.w3.org/TR/vc-data-model#PARSING_ERROR)</h5>
<h5>[STATUS_NOT_UPDATED_ERROR](https://www.w3.org/TR/vc-data-model#STATUS_NOT_UPDATED_ERROR)</h5>
<h5>[CRYPTOGRAPHIC_SECURITY_ERROR](https://www.w3.org/TR/vc-data-model#CRYPTOGRAPHIC_SECURITY_ERROR)</h5>
<h5>[MALFORMED_VALUE_ERROR](https://www.w3.org/TR/vc-data-model#MALFORMED_VALUE_ERROR)</h5>
<h5>[RANGE_ERROR](https://www.w3.org/TR/vc-data-model#RANGE_ERROR)</h5>
<h5>[UNRESOLVABLE_DID_ERROR](https://www.w3.org/TR/vc-data-model#UNRESOLVABLE_DID_ERROR)</h5>
<h5>[STATUS_WARNING](https://www.w3.org/TR/vc-data-model#STATUS_WARNING)</h5>
<h5>[VALIDITY_PERIOD_WARNING](https://www.w3.org/TR/vc-data-model#VALIDITY_PERIOD_WARNING)</h5>
<h5>[CONTROLLER_MISMATCH_WARNING](https://www.w3.org/TR/vc-data-model#CONTROLLER_MISMATCH_WARNING)</h5> #141
<h4>Verification Response</h4>
<code>
{
"verified": false,
"document": {},
"mediaType": "",
"controller": "",
"controllerDocument": {},
"warnings": [ProblemDetails],
"errors": [ProblemDetails]
}
</code>
</section>

</section>

<section class="appendix">
Expand Down