Why do we need a discovery URL in OpenID

Like https://www.google.com/accounts/o8/id and https://me.yahoo.com they send me the endpoint (https://www.google.com/accounts/o8/ud for google and https://open.login.yahooapis.com/openid/op/auth for yahoo) So my question is: can I skip this, am I just using the endpoint?

+6
source share
1 answer

For the initiation and discovery phase of the OpenID protocol, the user can pass either a URI or an XRI . If a URI is specified, then the YADIS protocol must be followed to find the service endpoint .

If the specified URL is different from the endpoint, the URL becomes the "declared identifier", and the OpenID provider can also provide a "local OP identifier". When starting the protocol, the user does not need to specify the endpoint URL. Therefore, this step should not be skipped.

As part of the discovery phase, various OpenID extensions that may be useful to your application can also be opened.

The OpenID protocol is well documented.

However, there is no reason why you cannot cache discovery results. For now, you can write code to skip the discovery phase if Yahoo! or the Google endpoint URL, the cache is a more general solution that will not be broken if the changed extensions are changed.

+7
source

Source: https://habr.com/ru/post/888653/


All Articles