<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Yes that would be a problem. The example in 4.2 should probably be doing a slice(0, lastIndexOf(' ')) rather than a split(' ').<div><br></div><div>Or whatever the correct JS syntax is to split on the rightmost ' '. Having spaces in the client ID is not ideal, but it is not the end of the world as long as there are no spaces in the session state.</div><div><br></div><div>In principal as the client_id is issued by the AS it would know if split(' ') is safe to use.</div><div><br></div><div>Worth calling out though.</div><div><br><div><div>On Feb 4, 2014, at 12:28 PM, Brian Campbell <<a href="mailto:bcampbell@pingidentity.com">bcampbell@pingidentity.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div>In <a href="http://openid.net/specs/openid-connect-session-1_0.html#RPiframe">4.1 of Session Management </a>"The postMessage from the RP iframe delivers the
following concatenation as the data: <b>Client ID + " " + Session State</b>"
and 4.2 the OP has to <br><br></div>Wouldn't that break for client ids that contain spaces, when in <a href="http://openid.net/specs/openid-connect-session-1_0.html#OPiframe">section 4.2</a>, the OP attempts to parse those two items out from the data (and yes, spaces are allowed per the <a href="http://tools.ietf.org/html/rfc6749#appendix-A.1">client_id ABNF in RFC 6749</a>)?<br>
<br><br></div>
_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></blockquote></div><br></div></body></html>