Should check TLS cert validity before sending assertion to the verifier

iriscouch / browserid_couchdb

Mozilla BrowserID support plugin for CouchDB

Apache License 2.0

57 stars 9 forks source link

Should check TLS cert validity before sending assertion to the verifier #23

Open fmarier opened 11 years ago

fmarier commented 11 years ago

As per a comment in the code, the TLS certificate for verifier.login.persona.org should be checked before the output is parsed.

Otherwise, an attacker could mount a DNS poisoning attack and swap the real verifier for their own hostile verifier. This would allow the attacker to impersonate anybody on the site.