Subject: [OAUTH-WG] session status change notification questions

From: "Brock Allen" <[email-masked]>
Date: Mon, 12 Jan 2015 08:11:20 -0500

A couple of questions about the session management spec related to the status change notifications (section 4): 

1) Is there a working reference implementation of the JavaScript that goes with the current draft of the spec?

2) For the statement from section 4.2: “The OP iframe MUST enforce that the caller has the same origin as its parent frame.” I’m uncertain how to do this in the OP iframe, given that it seems to be a cross-origin security concern to ascertain the origin of the parent window. I don’t think ‘referrer’ is the most reliable approach.

3) The spec states that the OP iframe and the RP iframe should be both contained within the main RP window (so the iframes are siblings). Is there a reason the RP iframe can’t contain the OP iframe?

If it can, then this would address my question #2 above, as the source.window (on the message event args) can be compared to the parent.window to ensure that only the parent is sending the messages.

Thanks.

-Brock

---

From: John Bradley <[email-masked]>
Date: Mon, 12 Jan 2015 10:21:09 -0300

If you are talking about this spec http://openid.net/specs/openid-connect-session-1_0.html <http://openid.net/specs/openid-connect-session-1_0.html>,  then the correct list for questions is the openid Connect one at http://lists.openid.net/mailman/listinfo/openid-specs-ab <http://lists.openid.net/mailman/listinfo/openid-specs-ab>.

Session management is not currently a OAuth WG document.

John B.

> On Jan 12, 2015, at 10:11 AM, Brock Allen <[email-masked]> wrote:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: "Brock Allen" <[email-masked]>
Date: Mon, 12 Jan 2015 12:35:40 -0500

Yep, my mistake. Apologies for the spam (including this apology email).

-Brock

From: John Bradley [mailto:[email-masked]] 
Sent: Monday, January 12, 2015 8:21 AM
To: Brock Allen
Cc: [email-masked]
Subject: Re: [OAUTH-WG] session status change notification questions

If you are talking about this spec http://openid.net/specs/openid-connect-session-1_0.html,  then the correct list for questions is the openid Connect one at http://lists.openid.net/mailman/listinfo/openid-specs-ab.

John B.

On Jan 12, 2015, at 10:11 AM, Brock Allen <[email-masked] <mailto:[email-masked]> > wrote:

 

 

 

Thanks.

-Brock

_______________________________________________
OAuth mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/oauth> https://www.ietf.org/mailman/listinfo/oauth