search

SCS-CBU-CED-IAM / mobileid-helper

Mobile ID Test Signature Portal
1 stars 1 forks source link

Wrong usage of timeout values #52

Closed phaupt closed 10 years ago

phaupt commented 10 years ago

Configuration according to 'mobileid.php':

public $TimeOutWSRequest  = 90;         // Timeout WS request
public $TimeOutMIDRequest = 80;         // Timeout MobileID request

Usage in 'mobileid.php':

curl_setopt($ch, CURLOPT_TIMEOUT, $this->TimeOutMIDRequest);

...and...

private function setSoapRequest() {
  <mss:TimeOut>'.$this->TimeOutWSRequest.'</mss:TimeOut>

BUG DESCRIPTION: 1) WS (socket timeout on local server) and MID (timeout for remote MSSP service) are swapped by mistake

2) According to ETSI'204 the MSSP TimeOut must be defined as an Attribute of MSS_SignatureReq and not as an Element. Otherwise it is not ETSI compliant and it doesn't work.

Correct way should be:

curl_setopt($ch, CURLOPT_TIMEOUT, $this->TimeOutWSRequest);

...and...

<mss:MSS_SignatureReq MinorVersion="1" MajorVersion="1" xmlns:mss="http://uri.etsi.org/TS102204/v1.1.2#" MessagingMode="synch" TimeOut="'.$this->TimeOutMIDRequest.'" xmlns:fi="http://mss.ficom.fi/TS102204/v1.0.0#">