did:web normalization/canonicalization

[DavidBuchanan314]

Are did:web:example.com and did:web:ex%61mple.com the same DID? Are they both valid DIDs?

[DavidBuchanan314]

(similar questions also apply to did:plc)

[bnewbold]

my short take is that percent encoding should not be used in conjunction with the did:web and did:plc methods. both methods only allow ASCII characters in the "identifier" part of the DID method, at least as currently supported in atproto (which doesn't allow the path segmentation feature of did:web). I think our current SDKs don't attempt any normalization.

you do raise a good point about DIDs in general, and how to handle percent encoding when it is encountered even when it isn't needed. we could try to kick the can down the road a bit by rejecting percent encoding at the syntax level with the current DID methods, but that is messy and might not be implemented correctly.

relatedly, note that DIDs in general are case-sensitive, and hypothetically the "identifier" part should not be normalized to lower-case.

[DavidBuchanan314]

the spec does have an explicit allowance for percent-encoded colons, as a means to specify a port number for a localhost did:web https://atproto.com/specs/did#blessed-did-methods - but only for dev/testing

[matthieusieben]

My take on this is that the identifier is the string itself. If the string is different than another string, then it is another identifier. ie. did:web:example.com and did:web:ex%61mple.com are different.

Since they are both syntactically correct, the DID method should specify where percent encoding can actually be used. did:web already describes how to encode a port number (using an encoded colon). Other cases of url encoding should, IMO, be rejected when validating against the specific method. It should be made explicit that the use of percent encoding is not allowed in did:plc.