fix(did): default allowedHttpHosts to [] in getDidResolver (HTTPS-only)

demos/e2e/src/index.ts

@@ -41,7 +41,7 @@ const CHAIN_ID = caip2ChainIds.baseSepolia
  * Their constructor adds their own DIDs to the resolver cache to
  * ensure they are always resolvable.
  */
-const resolver = getDidResolver()
+const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
 
 const credentialIssuer = await CredentialIssuer.create({
   baseUrl: "https://issuer.example.com",

demos/identity-a2a/src/bank-client-agent.ts

@@ -382,7 +382,7 @@ class BankClientAgent extends Agent {
     try {
       logger.log("🔍 Resolving bank teller DID document...")
 
-      const resolver = getDidResolver()
+      const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
       const didResult = await resolveDid(serverDid, resolver)
       const didDocument = didResult.didDocument
 

demos/identity-a2a/src/issuer.ts

@@ -20,7 +20,7 @@ const issuerDidDocument = createDidDocumentFromKeypair({
 
 const signer = createJwtSigner(issuerKeypair)
 
-const resolver = getDidResolver()
+const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
 resolver.addToCache(issuerDid, issuerDidDocument)
 
 export const didResolverWithIssuer = resolver

demos/identity/src/index.ts

@@ -32,7 +32,7 @@ import { serveAgent } from "./serve-agent"
 
 const currentDir = dirname(fileURLToPath(import.meta.url))
 
-const resolver = getDidResolver()
+const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
 
 const welcomeMessage = `${colors.bold("\n🔐 Welcome to the Agent Commerce Kit Identity (ACK-ID) Demo! 🔐")}
 This interactive demo will guide you through the fundamental concepts of ACK-ID.  We'll demonstrate how to establish verifiable identities for AI agents and their owners, and how agents can securely verify each other's identities before interacting.

demos/payments/src/index.ts

@@ -244,7 +244,7 @@ The Client attempts to access a protected resource on the Server. Since no valid
     ),
     colors.bold("📄 Receipt Details (Verifiable Credential):"),
   )
-  const resolver = getDidResolver()
+  const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
   const parsedDetails =
     typeof details === "string"
       ? await parseJwtCredential(details, resolver)

demos/payments/src/payment-service.ts

@@ -131,7 +131,7 @@ async function validatePaymentOption(
   paymentOptionId: string,
   paymentRequestToken: JwtString,
 ) {
-  const didResolver = getDidResolver()
+  const didResolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
 
   log(colors.dim(`${name} Verifying payment request token...`))
   const { paymentRequest } = await verifyPaymentRequestToken(

demos/payments/src/receipt-service.ts

@@ -66,7 +66,7 @@ app.post("/", async (c) => {
   const serverIdentity = await getKeypairInfo(
     env(c).RECEIPT_SERVICE_PRIVATE_KEY_HEX,
   )
-  const didResolver = getDidResolver()
+  const didResolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
 
   const { payload } = v.parse(bodySchema, await c.req.json())
 

demos/payments/src/server.ts

@@ -41,7 +41,7 @@ app.onError((e, c) => {
  */
 app.get("/", async (c): Promise<TypedResponse<{ message: string }>> => {
   const serverIdentity = await getKeypairInfo(env(c).SERVER_PRIVATE_KEY_HEX)
-  const didResolver = getDidResolver()
+  const didResolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
 
   const { publicKey: solanaServerPublicKey } = await ensureSolanaKeys(
     "SOLANA_SERVER_PUBLIC_KEY",

examples/issuer/src/middleware/did-resolver.ts

@@ -10,7 +10,7 @@ declare module "hono" {
 export function didResolver(): MiddlewareHandler<Env> {
   return async (c, next) => {
     const issuer = c.get("issuer")
-    const resolver = getDidResolver()
+    const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
     // There are certain points where we need to resolve our own DID (when we parse a JWT that we signed, for example).
     // However, CF workers cannot invoke themselves, so an attempt to resolve our own DID will fail. To get around this,
     // we pre-populate the cache with our own DID document.

examples/verifier/src/routes/verify.ts

@@ -34,7 +34,7 @@ app.post(
   "/",
   sValidator("json", bodySchema),
   async (c): Promise<ApiResponse<null>> => {
-    const resolver = getDidResolver()
+    const resolver = getDidResolver({ webOptions: { allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"] } })
     let { credential } = c.req.valid("json")
 
     if (isJwtString(credential)) {

packages/did/src/did-resolvers/get-did-resolver.ts

@@ -21,10 +21,17 @@ interface GetDidResolverOptions extends ResolverOptions {
  *
  * @param options - The {@link GetDidResolverOptions} to use for the did resolver
  * @returns A new {@link DidResolver} instance
+ *
+ * @remarks
+ * By default no hosts are allowed to serve DID documents over plain HTTP —
+ * all resolution uses HTTPS. Pass `webOptions.allowedHttpHosts` to permit
+ * specific hosts (e.g. `["localhost", "127.0.0.1"]` during local development).
+ * Allowing HTTP in production exposes DID documents to man-in-the-middle
+ * substitution, so the default is intentionally restrictive.
  */
 export function getDidResolver({
   webOptions = {
-    allowedHttpHosts: ["localhost", "127.0.0.1", "0.0.0.0"],
+    allowedHttpHosts: [],
   },
   ...options
 }: GetDidResolverOptions = {}): DidResolver {