3 ms·
Since it isn't specified as part of the spec, browsers would potentially have a different implementation for each OpenID provider, so yeah, that's a problem.
by mbreese 15y ago
Since it isn't specified as part of the spec, browsers would potentially have a different implementation for each OpenID provider, so yeah, that's a problem.
- pornel 15y agoClient<>Provider authentication method is not visible in the in OpenID protocol between Provider<>Consumer. Can you elaborate where the problem lies? Why would different auth methods in browsers cause problems, when different provider's methods don't? AFAIK client auth method is invisible and irrelevant, especially in the case where client and provider are the same thing (the browser). In fact, in-browser OpenID (where browser is the provider) could skip client authentication completely and just say "yes" to every consumer (because browser knows and trusts its own identity).