ansaurus

Question

How is an OpenID Client supposed look up the OpenID delegate?

Answer 1

A:

I was able to find on the website just talks about “the head section” of the HTML document, which however by HTML4/5 standards is implicit.

Where did you find this? I searched through the standards and didn't find any mention of the "head section" (it talks about the "head element"); the closest I came on a broader search was that most implementations are lax in requiring an explicit <html> and <head>, but this was presented more as a case of magnanimously accepting non-compliant documents than as a part of the standard.

MarkusQ 2009-03-23 19:46:21

The reference i found: http://openid.net/specs/openid-authentication-1_1.html#anchor4

Armin Ronacher 2009-03-23 23:23:22

Answer 2

+1 A:

I think it is assumed that an HTML page should have a HEAD tag. Most do, even if it's not strictly required by some standards.

However, the OpenID standard seems to require its tags to be placed in the HEAD tag. Do other sites detect your OpenID when it's not in HEAD?

Greg 2009-03-23 23:46:30

Answer 3

+1 A:

The bug is in your HTML page that declares the delegate. The HTML and HEAD tags are required to be around the delegate tag for a very good security reason. If this were not required, then many web pages like wiki's and blog pages could be hijacked for their identity merely by leaving a comment that included a specially crafted tag.

The "head section" referred to by OpenID is indeed the HEAD tag in an HTML page. Although I haven't read the entire beefy thing, I'd be drop-dead surprised if the HTML spec itself didn't mandate a surrounding HTML tag, and that all META tags must be within a HEAD tag. In my opinion, the OpenID spec doesn't go into detail about all the HTML requirements because it's a spec about OpenID and not HTML, but "head section" is a reference to the HTML spec, just as it references many other specs.

In conclusion, I believe StackOverflow.com is doing the right thing.

Andrew Arnott 2009-03-24 05:46:36

As I said. The HTML spec does not require it. You can check it yourself with a validator. The head section is implicit. It basically means that a <link> / <meta> tag can only appear inside <head> and thus it's considered part of a <head> tag even if not mentioned.

Armin Ronacher 2009-03-24 19:09:00

Answer 4

A:

I found this solution on getopenid.com :

"If you have a blog or homepage you'd like to use as your OpenID, you don't have to set up a server! Just copy the following into the head part of your HTML or XHTML, and use that URL.

link rel="openid.server" href="http://getopenid.com/action/authenticate/"
link rel="openid.delegate" href="http://getopenid.com/YOURIDENTITY/"

Note that you cannot use secure signons with this URL unless you have your own SSL server. Sites will also see you as a different person than when you directly use your identity from GetOpenID.com."

I think you have to replace getopenid.com with your OpenID provider and YOURIDENTITY with your OpenID identity.

Irina C 2009-03-24 06:19:20

Whiel there's technicly nothing wrong in what you say, you fail to realize that www.myopenid.com/server is his OpenID proveder and mitsuhiko.myopenid.com is his OpenID identity. That is because MyOpenID uses a YOURIDENTITY.myopenid.com format for the OpenID identities.

DJ Pirtu 2009-03-24 06:43:33

ansaurus

tags:

views:

answers:

How is an OpenID Client supposed look up the OpenID delegate?

related questions