Comment 3 for bug 538861

Revision history for this message
AMcBain (mcbain-asm) wrote :

Not being able to edit your own comments suck. I believe my previous statement of

 "Another usage for this patch is if an app wants to have a login on one URL but have it handled by another on a different domain, for example."

is actually against the OpenID spec.* The real way to do that would be to have the target of the form be the receiver page and have them handle the rest of the authentication. So the only actual use-case for this patch is dealing with Play! instances behind proxies, in which case there may be a better way to accomplish this, which tells the Play! Router that it is proxied and what the actual outside URL is, since it appears that the server acting as the proxy (in my case, Apache) can't handle everything.

* Since the realm and domain don't match, the authority provider has the right to drop the request in the possible interest of security.