iriscouch/browserid_couchdb — Issue #8: posting an assertion should not require URL-encoded data
Author: gfxmonk
Created: 2012-02-07 08:31:57+00:00
State: open

In /_browserid/main.js, the gotVerifiedEmail function makes a POST to _browserid with the assertion data & audience. The function uses window.encodeURIComponent on the value of each JSON key. This doesn't make any sense (it's JSON, not a form submission).

The function that uses this data in `verify_id_with_crutch` should be the one to urlencode this data before sending the request to browserid.org, otherwise all clients posting to _browserid will have to replicate this behaviour.