<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
J Panzer wrote:
<blockquote cite="mid:46FD1951.6040102@acm.org" type="cite">
<pre wrap="">Martin Atkins wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Johannes Ernst wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I'm one of the guys who actually maintains an ACL (Access Control List)
based on OpenID identities. The process works like this:
- Customer: hey, I'd like access to your website
- Me: sure, send me your OpenID
- Customer: foo.bar.com
- Me: adding <a class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</a> to the ACL
- Customer: hey, I tried but it doesn't work
- Me (diagnosing): that's because you entered '<a class="moz-txt-link-freetext" href="https://foo.bar.com/">https://foo.bar.com/</a>'
and not '<a class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</a>".
This happens in a surprisingly large number of cases.
</pre>
</blockquote>
<pre wrap="">
I believe the recommended pattern is to have the http: form redirect to
the https: form, thus allowing foo.bar.com to be entered:
* Consumer normalizes to <a class="moz-txt-link-freetext" href="http://foo.bar.com/">http://foo.bar.com/</a>
* Consumer gets redirected to <a class="moz-txt-link-freetext" href="https://foo.bar.com/">https://foo.bar.com/</a>
</pre>
</blockquote>
<pre wrap=""><!---->
If an attacker can compromise the http version, and redirects to
<a class="moz-txt-link-freetext" href="https://foo.bar.com.evil.org">https://foo.bar.com.evil.org</a> in this step, there should be an error
displayed, right? Shouldn't this be documented explicitly?</pre>
</blockquote>
If an attacker compromised the http version than he most likely
compromised also the https version (redirects can be done via http
header of the same system). However I'm not sure of there is any client
side capability implemented in this case, expect the client to
follow...However the issue of your question isn't that of http versus
https, but that of redirecting clients. How should the client behave
(follow?)<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>