968320 - A way to verify app:// origins in the Firefox Accounts verifier

Status: RESOLVED FIXED

(Core Graveyard :: Identity, defect)

Description

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

If an app posts an identity assertion up to its server, the server should be able to ask the Firefox Accounts verifier to verify the assertion, even if it has an app://something url.

Presently, the verifier rejects such origins - and for good reason, since a url of the form app://{guid} is inherently unverifiable.  But if the app has a stable, if arbitrary, origin in its manifest (the case for packaged apps), then the app's server should be allowed to tell the verifier that this is an accepted origin.

Such a change will require only simple changes to the DOM API, for which we already have Bug 947374, and a simple modification to the verifier.

Comment 1

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

Awesome.  trustedIssuers is already a part of the current verifier:

https://github.com/mozilla/browserid-verifier#optional-array-of-strings-trustedissuers

Comment 2

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

Wait.  What am I talking about.  That's completely irrelevant.  Sorry.  Move along ...

Comment 3

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

The good :fmarier will open a PR in the new verifier [1] that does something like this PR that I completely forgot I landed in the old verifier last year [2].

[1] https://github.com/mozilla/browserid-verifier
[2] https://github.com/mozilla/persona/pull/3334

Benson, do you know if the new 'browserid-verifier' has been deployed in production yet?  Or are we still using the old 'browserid' verifier for Persona and Firefox Accounts?

Comment 4

[Benson Wong [:mostlygeek]]

@jedp the new verifier (https://github.com/mozilla/browserid-verifier) is deployed at verifier.accounts.firefox.com. 

Let me know when your PR lands and I will deploy it. 

Ben

Comment 5

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

Thanks, Benson!

Comment 6

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

:fmarier remarks that, according to the unit tests, this feature is already live and deployed on the new verifier.  Thank you, Lloyd.