Switching samples to Medium trust, since setting originUrl allows out…

…bound HTTP to work.
beaubol · Aug 5, 2009 · 469553a · 469553a
1 parent 7b4b94f
commit 469553a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/samples/OpenIdProviderWebForms/Web.config b/samples/OpenIdProviderWebForms/Web.config
@@ -91,9 +91,10 @@
 		<!-- Trust level discussion:
 		Full: everything works
 		High: TRACE compilation symbol must NOT be defined
-		Medium/Low: doesn't work on default machine.config, because WebPermission.Connect is denied.
+		Medium: doesn't work unless originUrl=".*" or WebPermission.Connect is extended.
+		Low: doesn't work because WebPermission.Connect is denied.
 		-->
-		<trust level="High" originUrl=""/>
+		<trust level="Medium" originUrl=".*"/>
 		<pages>
 			<controls>
 				<add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>

diff --git a/samples/OpenIdRelyingPartyWebForms/Web.config b/samples/OpenIdRelyingPartyWebForms/Web.config
@@ -54,9 +54,10 @@
 		<!-- Trust level discussion:
 		Full: everything works
 		High: TRACE compilation symbol must NOT be defined
-		Medium/Low: doesn't work on default machine.config, because WebPermission.Connect is denied.
+		Medium: doesn't work unless originUrl=".*" or WebPermission.Connect is extended.
+		Low: doesn't work because WebPermission.Connect is denied.
 		-->
-		<trust level="High" originUrl=""/>
+		<trust level="Medium" originUrl=".*"/>
 	</system.web>
 
 	<!-- log4net is a 3rd party (free) logger library that dotnetopenid will use if present but does not require. -->