peterbe
commented
11 years ago I'm not convinced. There's got to be a better way to add this important functionality.
My beef is that django_browserid.getAssertion() does almost the exact thing as django_browserid.login but with a weird name. To begin with, instead of calling it getAssertion perhaps it should be loginWithCallback instead to fit in better.
Could we instead just do something like this:
django_browserid.login(function(assertion) {
...
})then, in django_browserid.login we assign a callable loginRedirect to use that isFunction to call the loginRedirect instead.
Or, in fact, that's not a good choice of name either. Perhaps we can just call it next. If it's a callable function, we call it, if it's a string we use it as argument to redirect. E.g.
var next = null; // for redirecting or callback after login and logout
...
function: login(_next, requestArgs) {
next = _next; // set the global variable for use with the navigator API later
}
Osmose
fmarier
coveralls
On Flicks, we ran into an issue where we wanted to perform an action that required a POST and a csrf token and prompt the user for login first if they aren't logged in. The problem is that if we attempt to log the user in prior to performing the action, django-browserid will redirect the user to a new page. If that new page automatically does the action, it will be vulnerable to a CSRF attack.
The alternative was to perform the action, store the intent in the user's session, and then prompt them for login, and perform the action post-login if the intent is found in their session. The issue with this is that the action requires an AJAX request, and calling the login code from within the AJAX handler causes popup warnings because navigator.id.request is being called outside of a click handler.
The next option was to use navigator.id.get to get an assertion, and then perform the action, and lastly submit the assertion for verification once the action was logged in their session. This would've worked, except include.js doesn't allow you to use navigator.id.get at the same time as navigator.id.watch.
Thus, this patch. It emulates the functionality of navigator.id.get using the watch API, and also adds a function to trigger the verification form submission in case anyone wants to trigger login from within the callback.
Long term I think we should change verifyAssertion to use an iframe so that we can finally support verification and login without leaving the page, but this should work in the short term and let me get on with my Flicks work. :D