sendAuthorizationResponse

Posts response, an authorization response or authorization error response for the response modes direct_post and direct_post.jwt, to the verifier, as application/x-www-form-urlencoded without a charset parameter, which some strict mDoc verifiers reject.

Finishes with the redirect_uri from the JSON body of the verifier's successful answer, which the wallet shall open in the user agent, or with null if the body is empty, no JSON, or has no redirect_uri (OpenID4VP 1.0, 8.2). A Location header is ignored. A non-success answer, including a redirect, fails with HttpErrorResponseException.

A redirect_uri that is not an absolute https URI with a host fails the exchange with an IllegalArgumentException, although the verifier has already processed response at that point. OpenID4VP 1.0, 8.2 only requires an absolute URI, so https is a policy of VC-K: the URI carries the fresh secret that protects against session fixation (OpenID4VP 1.0, 14.2), and other schemes, e.g. javascript:, data:, intent: or custom app schemes, would let the verifier run scripts or open other apps on the wallet's device. Any host is accepted, but an https URI without one is invalid (RFC 9110, 4.2.2).

Sends AuthorizationResponse.