juretta/Play20 — pull request #3 by juretta (2012-08-29 07:54:07+00:00)
Title: Direct verifiction MUST use discovery on the claimedId.

Remove the usage of the openid.op_endpoint query string parameter.

For the verification part Play's OpenID library is using "Direct verification"
(http://openid.net/specs/openid-authentication-2_0.html#check_auth
- 11.4.2. Verifying Directly with the OpenID Provider) and basically asks the
OP if the response is valid.

Only if the OP verifies the incoming data the UserInfo will be
populated with the information from the OP (e.g. OpenID and
potentially extended attributes like email, names).

Discovery (to discover the correct OP
endpoint to use) MUST happen on the claimed Id. See (11.2):
http://openid.net/specs/openid-authentication-2_0.html#verify_disco
"the Relying Party MUST perform discovery on the Claimed Identifier in
the response to make sure that the OP is authorized to make assertions
about the Claimed Identifier."

This change removes the usage of the openid.op_endpoint query string param as
that can easily be changed (a URL that returns 200 OK with a body of
"is_valid:true\n" is sufficient) which would allow an attacker to "verify" any
information contained in the verification payload.