Agent card client_id

What this check verifies

In draft-meunier-webbotauth-registry-03 the Signature Agent Card is an OAuth Client ID Metadata Document. Its client_id is an HTTPS URL that returns the card itself (section 3.1.1).

When the card carries a client_id, the checker compares it with the URL it fetched the card from, as a plain string comparison (RFC 3986, section 6.2.1, which the draft names):

• Identical: pass.
• Different: warning. The message shows both values.
• No client_id on the card: pass. The draft requires the field only on a card that is retrieved through its client_id, and the older registry-02 shape does not define it.

Because the comparison is on the exact string, a trailing slash, www against the apex, or a different path all count as a mismatch.

The check is advisory. It lowers the score slightly but never caps the grade and never changes the verdict.

Why it matters

A client that resolves a card through its client_id fetches that URL and requires the client_id in the returned document to be identical to it (registry-03, section 3.1.1). The protocol draft lets a signed request name a card directly, with a Signature-Agent member of type=cimd (draft-ietf-webbotauth-httpsig-protocol-00, section 5.5). A card whose client_id differs from the URL it is served at fails that comparison.

How to fix it

1. Set client_id to the exact HTTPS URL the card is served at.
2. Link the card from your directory or homepage with that same URL.
3. Serve the card at that URL directly with status 200. The draft forbids clients from following redirects and treats any other status as an error.

{
  "client_id": "https://example.com/bot",
  "client_name": "Example Bot",
  "jwks_uri": "https://example.com/.well-known/http-message-signatures-directory",
  "web_bot_auth": { "purpose": "search" }
}

References

• draft-meunier-webbotauth-registry-03, section 3.1.1, defines client_id and the identity rule; section 4.1 describes discovery through it.
• The Web Bot Auth protocol draft (draft-ietf-webbotauth-httpsig-protocol-00), section 5.5, defines the cimd member type.
• What is a Signature Agent Card? explains the card and both of its shapes.
• How grading works explains why card checks are advisory.