<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Attributes being signed is not a requirement for the AX spec and hence the concern if you are depending on verified attributes like email.<div><br></div><div>There is likely a configuration option in python-openid to reject unsigned attributes, but I don't know the code.</div><div><br></div><div>John B.<br><div><div>On 2012-07-26, at 6:54 PM, Mike Sun wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<div>
Hi --
</div><div><br></div><div>I'm using python-openid for my RP and Google Marketplace wanted to make sure this implementation is not vulnerable to spoofed, non-signed attributes such as email addresses.</div><div><br></div><div>See: <a href="http://googlecode.blogspot.com/2011/05/security-advisory-to-websites-using.html">http://googlecode.blogspot.com/2011/05/security-advisory-to-websites-using.html</a></div><div><br></div><div>Looking at the python-openid code, it seems that the default requires that only signed attributes are allowed to passed in the response.</div><div><br></div><div>See: <a href="https://github.com/openid/python-openid/blob/master/openid/extensions/ax.py">https://github.com/openid/python-openid/blob/master/openid/extensions/ax.py</a></div><div><br></div><div>Can anyone confirm that it is true that python-openid checks that the attribute is signed by the correct corresponding IDP?</div><div><br></div><div>Thanks,</div><div>Mike</div>
<div></div>
_______________________________________________<br>security mailing list<br><a href="mailto:security@lists.openid.net">security@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-security<br></blockquote></div><br></div></body></html>