3

When logging via OpenID to StackExchange sites, my OpenID provider says that it's not possible to verify Stack Exchange's consumer authenticity, meaning it can't verify return_to URL in OpenID request with the return_to URL in the XRDS document of the consumer.

As far as my understanding of OpenID 2.0 and Yadis protocols goes, the first step in this process is to get the XRDS document from openid.realm URL. Stack Exchange site produces this OpenID request:

https://mojeid.cz/endpoint/?openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.return_to=https%3A%2F%2Fmeta.stackexchange.com%2Fusers%2Fauthenticate%2F%3Fs%3D374a01e1-4442-404c-9845-f3db925330bf%26dnoa.userSuppliedIdentifier%3Dhttps%253A%252F%252Fmojeid.cz%252Fendpoint%252F&openid.realm=https%3A%2F%2Fmeta.stackexchange.com%2Fusers%2Fauthenticate%2F&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.alias3=http%3A%2F%2Fopenid.net%2Fsrv%2Fax%2F1.0&openid.alias3.if_available=alias1%2Calias2%2Calias3%2Calias4%2Calias5&openid.alias3.mode=fetch_request&openid.alias3.type.alias1=http%3A%2F%2Fschema.openid.net%2FnamePerson&openid.alias3.count.alias1=1&openid.alias3.type.alias2=http%3A%2F%2Fschema.openid.net%2Fcontact%2Femail&openid.alias3.count.alias2=1&openid.alias3.type.alias3=http%3A%2F%2Faxschema.org%2FnamePerson&openid.alias3.count.alias3=1&openid.alias3.type.alias4=http%3A%2F%2Faxschema.org%2Fcontact%2Femail&openid.alias3.count.alias4=1&openid.alias3.type.alias5=http%3A%2F%2Fstackexchange.com%2Fopenid%2Fax%2Femail%2Funverified&openid.alias3.count.alias5=1

So, Yadis request from my OpenID provider to openid.realm (https://meta.stackexchange.com/users/authenticate/) can look like (I'm adding --save-headers to see HTTP header and also | less for easier search):

wget --header='Accept:text/html; q=0.3, application/xhtml+xml; q=0.5, application/xrds+xml' --save-headers https://meta.stackexchange.com/users/authenticate/ -O- 2>&1 | less

Response to this request should contain one of these three:

  1. XRDS document in the body (which doesn't, response is HTML page)
  2. HTTP header x-xrds-location containing URL of the actual XRDS document location (there is no such header)
  3. HTML page with HTML header containing <meta> tag x-xrds-location (sadly also this meta tag is not on the page)

So the first step of verifying consumer (getting XRDS document) fails and therefore Stack Exchange Meta (or any other site I'm trying to log into) is marked as not authentic (even though it let me log in).

So am I missing some OpenID/Yadis knowledge, or is this bug of StackExchange?

You must log in to answer this question.

Browse other questions tagged .