<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Allen Tom:
<blockquote cite="mid:48094FC9.7000208@yahoo-inc.com" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
1) The user does NOT want to sign into the site specified by the
return_to<br>
2) We don't know that the authentication request originated from that
site<br>
3) The OpenID 2.0 spec does not require OPs to send a negative
assertion.<br>
<br>
So why would we want to send the user there?<br>
</blockquote>
<br>
This sounds somewhat lame. And what if the user didn't intended to
login with Yahoo but with something else and hit that button by mistake
instead of a different one? And for what is the return_url if not to
send the user back to whatever the return_url is set, including failure
state? I'd expect (as an RP) to receive a reply and inform the user of
the failure, that's all...<br>
<br>
<div class="moz-signature">-- <br>
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>