yesodweb/authenticate — Issue #7: Please implement BrowserID assertion verification directly, without using browserid.org/verify
Author: joshtriplett
Created: 2012-02-13 17:38:21+00:00
State: open

Currently, checkAssertion in Web.Authenticate.BrowserID just does a POST to https://browserid.org/verify . Please consider implementing BrowserID assertion verification directly. See https://wiki.mozilla.org/Identity/BrowserID#Assertion_Verification (and the preceding bits on that page) for the specification, and https://github.com/mozilla/browserid/blob/dev/bin/verifier for the source of the reference validator (written with node.js). (For the latter, note that the real work happens in the libraries loaded from https://github.com/mozilla/browserid/tree/dev/lib/verifier .)