<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1"><font face="Comic Sans MS">that's correct - you can use
an auto submit form with GET or use javascript
(document.location.replace) or META redirect tag to make the browser do
a GET. We are doing this for a very very long time too - mainly the
javascript method as it helps in restoring the back button
functionality (better UE).<br>
<br>
- Praveen<br>
<br>
<br>
</font></font><br>
<a class="moz-txt-link-abbreviated" href="mailto:dick@sxip.com">dick@sxip.com</a> wrote:
<blockquote cite="mid38701357-5A54-4CD0-AB59-66F39ED4E1F8@sxip.com"
type="cite">
<pre wrap="">On 7-Nov-06, at 12:34 PM, Recordon, David wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Moving this to the list, I really should have started it there in the
first place.
--David
-----Original Message-----
From: Recordon, David
Sent: Monday, November 06, 2006 2:06 PM
To: 'Dick Hardt'; Josh Hoyt
Subject: RE: IdP's Advertising Both http and https
Hey Dick,
But the security warnings will still exist:
- RP redirects me to http on IdP
- IdP redirects me to https on IdP for login page (warning)
</pre>
</blockquote>
<pre wrap=""><!---->
no warning on GET redirects
</pre>
<blockquote type="cite">
<pre wrap=""> - I interact with IdP for "trust request" via https
- I submit HTTPS form
- IdP redirects me back to RP via http (warning)
</pre>
</blockquote>
<pre wrap=""><!---->
not if you do a GET redirect
</pre>
<blockquote type="cite">
<pre wrap="">Am I missing something here?
</pre>
</blockquote>
<pre wrap=""><!---->
redirected POSTs produce a warning, redirected GETs do not
</pre>
<blockquote type="cite">
<pre wrap="">I guess I'm not sure what I think we should do, though don't think
this
is a simple problem.
</pre>
</blockquote>
<pre wrap=""><!---->
We built this out with our SXIP 2.0 code. Worked fine. No warnings.
-- Dick
_______________________________________________
specs mailing list
<a class="moz-txt-link-abbreviated" href="mailto:specs@openid.net">specs@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/specs">http://openid.net/mailman/listinfo/specs</a>
</pre>
</blockquote>
</body>
</html>