Hi,<br><br>You're correct: openid.rpsig is not in the specs. This must be an implementation-specific parameter added by an RP, probably to help skip the discovery step when the OP returns the message by allowing the RP to verify that the OP hasn't tampered with the return_to URL. No way to know for sure without cracking open the code of the RP that is crafting the parameter. (or a developer on this list who happens to be familiar with that code).<br>
<br>IMO, this implementation-specific parameter should <i>not</i> be using the 'openid.' prefix to its parameter name. That should be considered a reserved prefix for official parameters, since now if a future version of the openid spec were to add an openid.rpsig parameter to the protocol there would be a conflict. <br>
<br>DotNetOpenAuth adds some RP-specific parameters as well, but it uses its own "dnoa." prefix for parameter names to avoid this problem.<br><br clear="all">--<br>Andrew Arnott<br>"I [may] not agree with what you have to say, but I'll defend to the death your right to say it." - Voltaire<br>
<br><br><div class="gmail_quote">On Tue, Apr 28, 2009 at 10:55 AM, PepitoGrillo <span dir="ltr"><<a href="mailto:sengirpaladin@hotmail.com">sengirpaladin@hotmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
Good day to everyone<br>
<br>
I have already signed in the mailing list<br>
<br>
I am studying OpenID and investigating how it works using some Wireshark<br>
captures I have made<br>
I have seen this attribute, rpsig (openid.rpsig), in many requests and<br>
answers; but it does not appear in the OpenID Specifications (I have<br>
searched for it with no result in them...)<br>
I know about the attribute sig (openid.sig) and I know how it works, but the<br>
attribute rpsig is a mistery for me...<br>
<br>
Would you mind explaining me what does it sign and who signs it?<br>
I believe the signer is the Relying Party, but there is no field which says<br>
which attributes are signed, so I am a bit confused about this attribute<br>
<br>
Thanks in advance and have a nice day ! (^_^)<br>
<font color="#888888">--<br>
View this message in context: <a href="http://www.nabble.com/Question-from-a-beginner-about-the-attribute-%22RPSIG%22-tp23253484p23253484.html" target="_blank">http://www.nabble.com/Question-from-a-beginner-about-the-attribute-%22RPSIG%22-tp23253484p23253484.html</a><br>
Sent from the OpenID - General mailing list archive at Nabble.com.<br>
<br>
_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@openid.net">general@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
</font></blockquote></div><br>