Skip to content
This repository has been archived by the owner on May 10, 2021. It is now read-only.

UPort sendVerification creates multiple verified credentials #282

Closed
javaadpatel opened this issue Jul 2, 2019 · 1 comment
Closed

UPort sendVerification creates multiple verified credentials #282

javaadpatel opened this issue Jul 2, 2019 · 1 comment

Comments

@javaadpatel
Copy link

javaadpatel commented Jul 2, 2019

Hi,
I'm learning to use UPort connect so might have missed something obvious, but I am using this code:

 uport.sendVerification({
            exp: Math.floor(new Date().getTime() / 1000) + 30 * 24 * 60 * 60,
            claim: {
                'AnotherExample': {
                    'Last Seen': `${new Date()}`,
                    'Rank': '9'
                }
            }
        });

I would like to send another verification at a later time and then update the property 'Rank', but when i send another verification it not overwrite the previous one I sent. On the uPort app there is then two entries in the Credentials tab. Is there a property that i can set to say that this must modify an existing verification? If not, what is the common way of dealing with this? I see that when I do:

uport.requestDisclosure({
            requested: ['name'],
            verified: ['AnotherExample']
        });

then i get both verifications 'AnotherExample' back, so I guess I could look at the iat field to see which is the most recent one?

@mirceanis
Copy link

Is there a property that i can set to say that this must modify an existing verification?

The current spec does not cover this scenario. The credentials are considered valid for the entire interval between iat and exp. Revocation mechanism could be used but they are not part of verification spec now.

If not, what is the common way of dealing with this?

A common way of dealing with this may be to issue credentials that expire faster. Those can later be ignored more easily. Another possible scenario is using an external revocation mechanism.
In your case, another external mechanism is your own business logic - where you only consider the latest credential of that type.

I'm closing this issue, please reopen if the answer is not clear enough.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants