-
Notifications
You must be signed in to change notification settings - Fork 6
Normalize discovered URIs before comparing them #41
Conversation
#42 fixes the CI failures here. I plan to rebase this once that PR lands. |
python-openid2's urinorm is stricter than that in the old Python-2-only version: in particular, it always normalizes the reserved character '+' to '%2B'. The discovery process normalizes URIs, so GenericConsumer._verifyDiscoverySingle could end up comparing normalized and unnormalized identifiers. In particular, this broke with the Ubuntu single-sign-on system (login.ubuntu.com / login.launchpad.net) which includes a '+' character in the path part of its identifiers. It makes sense to normalize both expected and discovered identifiers before comparing them, so do that according to the rules in OpenID Authentication 2.0 section 7.2.
726ed18
to
9b980fd
Compare
Rebased now, so CI should be happy shortly. |
Codecov Report
@@ Coverage Diff @@
## master #41 +/- ##
=======================================
Coverage 89.48% 89.49%
=======================================
Files 93 93
Lines 12015 12058 +43
Branches 1084 1087 +3
=======================================
+ Hits 10752 10791 +39
- Misses 1094 1096 +2
- Partials 169 171 +2
Continue to review full report at Codecov.
|
@ziima @tpazderka Would there be any chance of getting a review of this, please? I have I think three other projects so far that are blocked on this as part of their Python 3 upgrades. |
Sorry about the delay and thanks for poking us :-) I believe the cause is in the |
Closing, since #43 fixed the issue. |
python-openid2's urinorm is stricter than that in the old Python-2-only
version: in particular, it always normalizes the reserved character '+'
to '%2B'. The discovery process normalizes URIs, so
GenericConsumer._verifyDiscoverySingle could end up comparing normalized
and unnormalized identifiers.
In particular, this broke with the Ubuntu single-sign-on system
(login.ubuntu.com / login.launchpad.net) which includes a '+' character
in the path part of its identifiers.
It makes sense to normalize both expected and discovered identifiers
before comparing them, so do that according to the rules in OpenID
Authentication 2.0 section 7.2.