Add did:web resolver and unified DID resolution #28

New issue

Closed

opened 2026-04-12 17:29:48 +00:00 by Grandiras · 0 comments

Grandiras commented

2026-04-12 17:29:48 +00:00

Owner

Summary

The AT Protocol specifies did:web as one of the supported DID methods. While ATProto.NET has did:plc resolution via PlcClient, there's no dedicated did:web resolver.

Spec Reference

From the DID specification:

did:web resolves by fetching https://<domain>/.well-known/did.json
The DID document format is the same W3C DID Document used by did:plc
did:web is used by services and infrastructure (e.g., did:web:api.bsky.app)

What's needed

did:web resolver - Fetch and parse DID documents from .well-known/did.json
Unified DID resolution - Dispatch to the correct resolver based on DID method:
- did:plc:* → PLC directory
- did:web:* → HTTPS well-known endpoint
DID document caching - Cache resolved DID documents with configurable TTL
Security validation - HTTPS required, domain validation, SSRF prevention

Why this matters

did:web is used by services like App Views, Relays, Labelers
Needed for verifying service-to-service auth (JWT with iss claim)
Needed for resolving proxy target services
Needed for complete DID resolution in identity layer

## Summary The AT Protocol specifies `did:web` as one of the supported DID methods. While ATProto.NET has `did:plc` resolution via `PlcClient`, there's no dedicated `did:web` resolver. ## Spec Reference From the [DID specification](https://atproto.com/specs/did): - `did:web` resolves by fetching `https://<domain>/.well-known/did.json` - The DID document format is the same W3C DID Document used by `did:plc` - `did:web` is used by services and infrastructure (e.g., `did:web:api.bsky.app`) ## What's needed 1. **`did:web` resolver** - Fetch and parse DID documents from `.well-known/did.json` 2. **Unified DID resolution** - Dispatch to the correct resolver based on DID method: - `did:plc:*` → PLC directory - `did:web:*` → HTTPS well-known endpoint 3. **DID document caching** - Cache resolved DID documents with configurable TTL 4. **Security validation** - HTTPS required, domain validation, SSRF prevention ## Why this matters - `did:web` is used by services like App Views, Relays, Labelers - Needed for verifying service-to-service auth (JWT with `iss` claim) - Needed for resolving proxy target services - Needed for complete DID resolution in identity layer