---
title: "MPP request whose bytes are not their canonical form — x402 defect class mpp-request-not-canonical"
description: "MPP request whose bytes are not their canonical form (mpp-request-not-canonical), an x402 defect class: Re-canonicalizing the decoded request by RFC 8785 (JCS) reproduces the served bytes exactly. Detectable by an unpaid probe. A client that hashes the request for challenge binding gets a different hash from the one the server computed, so a correct payment is refused as mismatched, or a careless server accepts a rebound one."
canonical: "https://scvd.store/defects/mpp-request-not-canonical"
url: "https://scvd.store/defects/mpp-request-not-canonical"
term_code: "mpp-request-not-canonical"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# MPP request whose bytes are not their canonical form

`mpp-request-not-canonical` — an x402 defect class.

**Asserts:** Re-canonicalizing the decoded request by RFC 8785 (JCS) reproduces the served bytes exactly.

**Costs:** A client that hashes the request for challenge binding gets a different hash from the one the server computed, so a correct payment is refused as mismatched, or a careless server accepts a rebound one.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** The served request bytes equalling the RFC 8785 canonicalization of their own decoded JSON at the stated moment.

**How an operator clears it:** Serialise the request with a JCS canonicalizer — sorted keys, no whitespace, ECMAScript number and string forms — rather than a pretty-printer or a hand-written template; the draft says MUST.

**What a buyer does:** Bind your credential to the bytes you were served, never to a re-serialisation of them, and expect a mismatch refusal from a server that hashes its own canonical form; if the door's own bytes are not canonical, tell the operator rather than retrying.

**Our signal:** `mpp-request-canonical`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.