ratsume / lightopenid

Automatically exported from code.google.com/p/lightopenid
0 stars 0 forks source link

only xrds returned from provider on client validate check #62

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
looking at the typical harness for openid/yadis like the example here:
http://blog.paulisageek.com/2009/06/easy-openid-delegation-with-yadis.html

when using lightopenid you MUST add a secondary check to 
if (strpos($_SERVER['HTTP_ACCEPT'], "application/xrds+xml") !== FALSE) {
when using the current implementation of 
https://gitorious.org/lightopenid/lightopenid/blobs/master/openid.php

i.e. 
if (strpos($_SERVER['HTTP_ACCEPT'], "application/xrds+xml") !== FALSE && 
!isset($_REQUEST['openid_mode']) {

the method "request_curl" adds 'Accept: application/xrds+xml, */*' regardless 
of the request method while "request_streams" DOES NOT add the header when the 
method is POST

"request_curl" should be corrected to
if($method != 'POST'){
  curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/xrds+xml, */*'));
}

Original issue reported on code.google.com by Jason.Me...@gmail.com on 16 Aug 2012 at 8:15