<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
The 2.0 Spec draft (
<a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-authentication-2_0-12.html">http://openid.net/specs/openid-authentication-2_0-12.html</a> ) speaks
about something different:<br>
<br>
<h3>Abstract</h3>
OpenID Authentication uses only standard HTTP(S) requests and
responses, so it does not require any special capabilities of the
User-Agent or other client software. OpenID is not tied to the use of
cookies or any other specific mechanism of Relying Party or OpenID
Provider session management. Extensions to User-Agents can simplify the
end user interaction, though are not required to utilize the protocol.<br>
<br>
and throughout the specs:<br>
<br>
<dl>
<dt>Identifier:</dt>
<dd> An Identifier is either a "http" or "https" URI, (commonly
referred to as a "URL" within this document), or an <a class="info"
href="http://openid.net/specs/openid-authentication-2_0-12.html#XRI_Syntax_2.0">XRI<span>
(</span><span class="info">Reed, D. and D. McAlpin, “Extensible
Resource Identifier (XRI) Syntax V2.0,” .</span><span>)</span></a>
[XRI_Syntax_2.0]. This document defines various kinds of Identifiers,
designed for use in different contexts.</dd>
</dl>
<br>
<h3>7.2.
Normalization</h3>
# Otherwise, the input SHOULD be treated as an http URL; if it does
not include a "http" or "https" scheme, the Identifier MUST be prefixed
with the string <a class="moz-txt-link-rfc2396E" href="http://">"http://"</a>. If the URL contains a fragment part, it MUST
be stripped off. See Section 11.5.2 (HTTP and HTTPS URL Identifiers)
for more information. <br>
<br>
<h3>11.5.2.
HTTP and HTTPS URL Identifiers</h3>
<p> Relying Parties MUST differentiate between URL Identifiers that
have different schemes. When end user input is processed into a URL, it
is processed into a HTTP URL. If the same end user controls the same
URL, differing only by scheme, and it is desired that the Identifier be
the HTTPS URL, <u><b>it is RECOMMENDED that a redirect be issued from
the HTTP URL to the HTTPS URL</b></u>. Because the HTTP and HTTPS URLs
are not equivalent and the Identifier that is used is the URL after
following redirects, there is no foreseen reduction in security when
using this scheme. If an attacker could gain control of the HTTP URL,
it would have no effect on the HTTPS URL, since the HTTP URL is not
ever used as an Identifier except to initiate the discovery process. </p>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
<br>
Stephane Bortzmeyer wrote:
<blockquote cite="mid:20070924101234.GA3214@nic.fr" type="cite">
<pre wrap="">On Thu, Sep 20, 2007 at 03:55:14PM -0700,
Paul C. Bryan <a class="moz-txt-link-rfc2396E" href="mailto:email@pbryan.net"><email@pbryan.net></a> wrote
a message of 59 lines which said:
</pre>
<blockquote type="cite">
<pre wrap="">OpenID is built on the HTTP(s) protocol,
</pre>
</blockquote>
<pre wrap=""><!---->
Checking the specification, it does not seem so. The specification
apparently only says that the identifier has to be resolvable (an URL,
not just any URI), which includes <a class="moz-txt-link-freetext" href="ftp://">ftp://</a> URLs (and <a class="moz-txt-link-freetext" href="gopher://">gopher://</a> :-)
That's why it would be a bad idea to make a special case for
http/https by saying that they must be the same. This would break the
simple rule that an identifier is any URL.
</pre>
</blockquote>
<br>
</body>
</html>