<div> <font face="Arial, Helvetica, sans-serif">with fairly good P3P policy from OP and with medium level privacy settings in all browsers, cookies are passed in outgoing requests. So this shouldn't be a problem unless the OP is trying to set some cookies in the response.<br>
<br>
Btw - I forgot which OPs that we found as breaking the frames early this year. So I will do some tests again and will send a list of OPs that are breaking iframes in checkid_immediate (and also not breaking frames in case of checkid_setup).<br>
<br>
- Praveen<br>
</font></div>
<div> <br>
</div>
-----Original Message-----<br>
From: John Panzer <jpanzer@acm.org><br>
To: alavillipraveen@aol.com<br>
Cc: general@openid.net<br>
Sent: Wed, 12 Nov 2008 8:49 am<br>
Subject: Re: [OpenID] OpenID UX and IIW session<br>
<br>
<div id="AOLMsgPart_3_cfde2298-e0e5-4ce4-b17c-495fb3115046">
What are the security rules around cookies and 3rd party domains used
in iframes? (My understanding is that there are some issues especially
around IE, but I can never remember what they are exactly; if there are
issues, then presumably cookie based OP sessions will have an issue
with using an asynchronous iframe to do checkid_immediate; if there are
workarounds, they'd need to be documented for UX implementors.)<br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:alavillipraveen@aol.com">alavillipraveen@aol.com</a> wrote:
<blockquote type="cite">
<div> <font face="Arial, Helvetica, sans-serif">Well, the problem is
with the redirect mechanism used (certain JS redirect functions break
frames) and in some cases I think it's the OP's left over frame busting
code from their standard login (checkid_setup) flow. <br>
<br>
Breaking iframes is a problem because it breaks UX - the RP instead of
just updating the user login status asynchronously, it has to handle a
return redirect from the OP, set it's auth session ( and cookies) and
redirect back to the site in authenticated state. Users will notice a
quick flash-through-empty page (based on their connection speed) and
of course add the click-click sounds in IE when JS based redirects are
used. Compare this to when HTTP status codes 301/302 are used to do the
redirects - RP can insert a hidden iframe loading the checkid_immediate
url behind the scenes to get user's authentication status and update
the user's authentication status on the web site accordingly without
actually doing any more redirects. <br>
<br>
"checkid_immediate" is essentially the way to detect user's
authentication status. Without it being iframe friendly, there is no
way to provide good UX like FBConnect to display your authentication
status automatically at sites where you already gave consent to.<br>
</font><font face="Arial, Helvetica, sans-serif"><br>
Another problem with using non 302 redirects is with the unnecessary
addition of the authentication urls in the browser's history thus
making it hard for the users to go back to the original site from where
they started from - but again this is only an issue if the redirects
are done in full browser window instead of in an iframe.</font><br>
<font face="Arial, Helvetica, sans-serif"><br>
So I think we should be more specific on the redirect mechanisms - for
example a few </font><font face="Arial, Helvetica, sans-serif">g</font>eneral
guidelines for implementing Redirects for OpenID Providers<b><font face="Arial, Helvetica, sans-serif"> </font></b><font face="Arial, Helvetica, sans-serif">should </font><font face="Arial, Helvetica, sans-serif">be</font><b><font face="Arial, Helvetica, sans-serif"> </font></b><font face="Arial, Helvetica, sans-serif">some thing like</font><b><br>
</b>
<ul>
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">Immediate requests</font></div>
<ol type="i">
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">OP MUST use standard HTTP redirect
mechanism (HTTP Status code 302 ) to redirect the user back to RP’s
return_to url.</font></div>
</li>
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">OP MAY use Javascript code to
initiate the redirect back to RP’s return_to url but it MUST not break
IFRAMEs.</font></div>
<ol>
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">Ex. Use document.location =
return_to url or document.location.replace(return_to url)</font></div>
</li>
</ol>
</li>
</ol>
</li>
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">Non-immediate requests</font></div>
<ol type="i">
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">OP MUST use standard HTTP redirect
mechanism (HTTP Status code 302) to redirect the user back to RP’s
return_to url.</font></div>
</li>
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">OP MAY use Javascript code to
break IFRAMEs but it MUST overwrite it’s own url with the RP’s
return_to url to preserve browser back button functionality.</font></div>
<ol>
<li>
<div style="margin-bottom: 0in;"><font face="Arial, Helvetica, sans-serif">Ex. Use parent.location =
return_to url or parent.location.replace(return_to url) or
top.location.href = return_to url </font></div>
</li>
</ol>
</li>
</ol>
</li>
</ul>
<font face="Arial, Helvetica, sans-serif"><br>
<br>
</font></div>
<div> <font face="Arial, Helvetica, sans-serif">- Praveen</font><br>
</div>
<div> <br>
</div>
-----Original Message-----<br>
From: Carl Howells <a class="moz-txt-link-rfc2396E" href="mailto:chowells@janrain.com"><chowells@janrain.com></a><br>
To: Praveen Alavilli <a class="moz-txt-link-rfc2396E" href="mailto:AlavilliPraveen@aol.com"><AlavilliPraveen@aol.com></a><br>
Cc: OpenID General <a class="moz-txt-link-rfc2396E" href="mailto:general@openid.net"><general@openid.net></a><br>
Sent: Tue, 11 Nov 2008 5:22 pm<br>
Subject: Re: [OpenID] OpenID UX and IIW session<br>
<br>
<div id="AOLMsgPart_0_fa6edfff-3b1a-423b-a95b-7f338cc09d68" style="margin: 0px; font-family: Tahoma,Verdana,Arial,Sans-Serif; font-size: 12px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<pre style="font-size: 9pt;"><tt>Praveen,<br>
<br>
<br>
<br>
A compliant OP, when receiving a checkid_immedate request, will never<br>
<br>
render an html page. It will *only* issue redirects.<br>
<br>
<br>
<br>
Given that, I fail to see how frame breaking comes into play.<br>
<br>
<br>
<br>
On Tue, Nov 11, 2008 at 3:19 PM, Praveen Alavilli<br>
<br>
<<a>AlavilliPraveen@aol.com</a>> wrote:<br>
<br>
> One of the big problems with using checkid_immediate is that several<br>
<br>
> OPs break iframes - so there is no reliable way of doing async with<br>
<br>
> checks with out doing a redirect inside the same browser window or in<br>
<br>
> a popup.<br>
<br>
</tt></pre>
</div>
<div id="MAILCIAMB042-92bd491a7c7b3b5" class="aol_ad_footer"><br>
<hr style="margin-top: 10px;"><font style="color: black; font-family: ARIAL,SAN-SERIF; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;">Instant
access to the latest & most popular FREE games while you browse
with the Games Toolbar - <a target="_blank" href="http://pr.atwola.com/promoclk/100000075x1212904500x1200818240/aol?redir=http://toolbar.aol.com/games/download.html?ncid=emlweusdown00000004">Download
Now!</a> </font></div>
<pre><font style="color: black; font-family: ARIAL,SAN-SERIF; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;"><br>
</font><hr size="4" width="90%"><font style="color: black; font-family: ARIAL,SAN-SERIF; font-style: normal; font-variant: normal; font-weight: normal; font-size: 10pt; line-height: normal; font-size-adjust: none; font-stretch: normal;"><br>
_______________________________________________<br>
general mailing list<br>
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a><br>
<a class="moz-txt-link-freetext" target="_blank" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a><br>
</font></pre>
</blockquote>
<br>
</div>
<!-- end of AOLMsgPart_3_cfde2298-e0e5-4ce4-b17c-495fb3115046 -->
<div id="AOLMsgPart_4_cfde2298-e0e5-4ce4-b17c-495fb3115046" style="margin: 0px; font-family: Tahoma,Verdana,Arial,Sans-Serif; font-size: 12px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<pre style="font-size: 9pt;"><tt>_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@openid.net">general@openid.net</a><br>
<a href="http://openid.net/mailman/listinfo/general" target="_blank">http://openid.net/mailman/listinfo/general</a><br>
</tt></pre>
</div>
<!-- end of AOLMsgPart_4_cfde2298-e0e5-4ce4-b17c-495fb3115046 -->
<div id='MAILCIAMA027-910d491b1d6734e' class='aol_ad_footer'><BR/><FONT style="color: black; font: normal 10pt ARIAL, SAN-SERIF;"><HR style="MARGIN-TOP: 10px"></HR>Instant access to the latest & most popular FREE games while you browse with the Games Toolbar - <a href="http://pr.atwola.com/promoclk/100000075x1212904500x1200818240/aol?redir=http://toolbar.aol.com/games/download.html?ncid=emlweusdown00000004">Download Now!</a> </div>