mozilla/browserid — Issue #649: browserid.org/verify does not accept form-data
Author: Fil
Created: 2011-11-24 07:55:18+00:00
State: open

Compare

curl -k -d "assertion=eyJjZXJ0aWZpY2F0ZXMiOlsiZXlKaGJHY2lPaUpTVXpFeU9DSjkuZXlKcGMzTWlPaUppY205M2MyVnlhV1F1YjNKbklpd2laWGh3SWpveE16SXlNVGN5TnpBd09EazBMQ0p3ZFdKc2FXTXRhMlY1SWpwN0ltRnNaMjl5YVhSb2JTSTZJbEpUSWl3aWJpSTZJamM1TURFMk9EWTJNelE1TmpnM01qRXdPREV5TWpVd01qQXdNRGN6T1RJd056WTVOREk0TWpVd056UTFOekEyT0RZek5qWTJORGsyTWpnMk9UQXhPRGt4TlRnek9EZzVNREF4TVRBeU5EWTRORGMyTnpZMU1qTTJNamd6TlRJNU16azNNVE00TURRMU16YzNNelk1T0RBME1qUXlOREUyTWpZME9EVTNNamc0TkRNd05qTTBNVFU0TVRrMk1UTTBPVEF4TnpFNU1EQTROemNpTENKbElqb2lOalUxTXpjaWZTd2ljSEpwYm1OcGNHRnNJanA3SW1WdFlXbHNJam9pWm1sc1FISmxlbTh1Ym1WMEluMTkuYm5pc3QxZU84cGRIc21PdTlGa3VEV3RrbFpKRW9JOXFuMzk1a2w0SmliZmo2STFFbHcta2l2NE1fZkMxWXlKMWxXd1FvMGVydTJNUGphak45UEZ0THhJU2ZCYU9TVTAtM0dSajM3cHRjTUdobzlabThVYWpiTS1lbS1ZTUEzSE5iRF9iZm1xbVkxMGdNSkxYUlB4RzZPYXNFUWtYZ1dad1VpLWY2VlJiRVh3Il0sImFzc2VydGlvbiI6ImV5SmhiR2NpT2lKU1V6WTBJbjAuZXlKbGVIQWlPakV6TWpJd09URXdORFU1TVRnc0ltRjFaQ0k2SW1oMGRIQTZMeTlzYjJOaGJHaHZjM1FpZlEubFFtclZabGQ1b1Ywb3RkYnE2cmVoQV80TmIxejd2amlSYWk0dVRJNW9KWkVtT25KLWNFN2NBY041X21tT2stQkY5NzlHLUFDb3V4d1dBbE5MNTlRYWcifQ&audience=https://mysite.com" "https://browserid.org/verify"
{"status":"failure","reason":"audience mismatch"}

and

curl -k -F "assertion=eyJjZXJ0aWZpY2F0ZXMiOlsiZXlKaGJHY2lPaUpTVXpFeU9DSjkuZXlKcGMzTWlPaUppY205M2MyVnlhV1F1YjNKbklpd2laWGh3SWpveE16SXlNVGN5TnpBd09EazBMQ0p3ZFdKc2FXTXRhMlY1SWpwN0ltRnNaMjl5YVhSb2JTSTZJbEpUSWl3aWJpSTZJamM1TURFMk9EWTJNelE1TmpnM01qRXdPREV5TWpVd01qQXdNRGN6T1RJd056WTVOREk0TWpVd056UTFOekEyT0RZek5qWTJORGsyTWpnMk9UQXhPRGt4TlRnek9EZzVNREF4TVRBeU5EWTRORGMyTnpZMU1qTTJNamd6TlRJNU16azNNVE00TURRMU16YzNNelk1T0RBME1qUXlOREUyTWpZME9EVTNNamc0TkRNd05qTTBNVFU0TVRrMk1UTTBPVEF4TnpFNU1EQTROemNpTENKbElqb2lOalUxTXpjaWZTd2ljSEpwYm1OcGNHRnNJanA3SW1WdFlXbHNJam9pWm1sc1FISmxlbTh1Ym1WMEluMTkuYm5pc3QxZU84cGRIc21PdTlGa3VEV3RrbFpKRW9JOXFuMzk1a2w0SmliZmo2STFFbHcta2l2NE1fZkMxWXlKMWxXd1FvMGVydTJNUGphak45UEZ0THhJU2ZCYU9TVTAtM0dSajM3cHRjTUdobzlabThVYWpiTS1lbS1ZTUEzSE5iRF9iZm1xbVkxMGdNSkxYUlB4RzZPYXNFUWtYZ1dad1VpLWY2VlJiRVh3Il0sImFzc2VydGlvbiI6ImV5SmhiR2NpT2lKU1V6WTBJbjAuZXlKbGVIQWlPakV6TWpJd09URXdORFU1TVRnc0ltRjFaQ0k2SW1oMGRIQTZMeTlzYjJOaGJHaHZjM1FpZlEubFFtclZabGQ1b1Ywb3RkYnE2cmVoQV80TmIxejd2amlSYWk0dVRJNW9KWkVtT25KLWNFN2NBY041X21tT2stQkY5NzlHLUFDb3V4d1dBbE5MNTlRYWcifQ" -F "audience=https://mysite.com" "https://browserid.org/verify"
{"status":"failure","reason":"need assertion and audience"}

The trouble here is that the verify service on https://browserid.org only accepts a x-www-form-urlencoded POST, and not a form-data encoded POST. It can be painful to understand… and should be easy to fix.