<html><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type"></head><body><div><div style="font-family:Calibri,sans-serif;font-size:11pt">As long as you don't mind the user who is logging in observing the data (not usually considered a problem) then SSL should be fine. And yes, requireSsl=true is a good setting to enforce this.<br>
<br>Sent from my Windows Phone<br></div></div><hr><span style="font-family:Tahoma,sans-serif;font-size:10pt;font-weight:bold">From: </span><span style="font-family:Tahoma,sans-serif;font-size:10pt">Russ Ferrill</span><br>
<span style="font-family:Tahoma,sans-serif;font-size:10pt;font-weight:bold">Sent: </span><span style="font-family:Tahoma,sans-serif;font-size:10pt">4/12/2012 1:05 PM</span><br><span style="font-family:Tahoma,sans-serif;font-size:10pt;font-weight:bold">To: </span><span style="font-family:Tahoma,sans-serif;font-size:10pt"><a href="mailto:openid-code@lists.openid.net">openid-code@lists.openid.net</a></span><br>
<span style="font-family:Tahoma,sans-serif;font-size:10pt;font-weight:bold">Subject: </span><span style="font-family:Tahoma,sans-serif;font-size:10pt">[Code] Encrypting communication between the OP and the RP</span><br><br>
</body></html><html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal">Hello,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I am implementing an Open ID provider using the DNOA code. I want to be sure that the communication between the OP and the RP is secure. I’m only concerned about authentication requests and authentication responses. As far as I can tell
from looking at the code this is all “indirect” communication accomplished by redirecting the end-user’s browser. I want to be sure that the data included in the authentication request and the authentication response is encrypted. In order to accomplish this,
do I have to do anything other than make the OP endpoint an https url protected by SSL? Would it be a good idea to set the require ssl configuration values to true? Is there anything else specific to the DNOA code that I need to configure or modify in order
to support this?</p>
<p class="MsoNormal">Thanks.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Russ Ferrill</p>
</div>
</body>
</html>