richardvanhook/omniauth-salesforce — pull request #6 by jonah-carbonfive (2012-03-07 19:56:37+00:00)
Title: Add tests and validate salesforce user id using signature

Built out specs to try to capture existing behavior.

Added validation of the provided user id using the signature field returned by Salesforce. With the client application posting an authorization code over a https connection such a check is probably unnecessary for most applications.

> signature
> Base64-encoded HMAC-SHA256 signature signed with the consumer's private key containing the concatenated ID and issued_at. This can be used to verify the identity URL was not modified since it was sent by the server.
From http://wiki.developerforce.com/page/Digging_Deeper_into_OAuth_2.0_at_Salesforce.com