971992 - Loop Server needs to validate bid assertion obtained from Firefox Accounts

Status: VERIFIED DUPLICATE of bug 971991

(Hello (Loop) :: Server, defect)

Comment 1

[Byron Campen [:bwc]]

This includes both the service (presumably a web service), and the actual validation logic behind it.

Comment 2

[Byron Campen [:bwc]]

Actually, this is _just_ the validation logic.

Comment 3

[Alexis Metaireau (:alexis)]

Actually, the MEET server does not need to know about browserid assertions. What needs to be sent there (and validated) is an auth token issued by the tokenserver, and a secret.

The node uses the Signing Secret to validate the Auth Token.

The node calculates the Token Secret from its Master Secret and the Auth Token, and checks whether the signature in the Authorization header is valid.

All the steps are defined here: http://docs.services.mozilla.com/token/user-flow.html

Comment 4

[Alexis Metaireau (:alexis)]

We're discarding the use of the token server for now; we need to call the remote verifier (or eventually get the certificates locally to do local verifications) to check the assertions are valid.

Comment 5

[Alexis Metaireau (:alexis)]

FTR, For local verifications we could use https://github.com/mozilla/browserid-local-verify

Comment 6

[Alexis Metaireau (:alexis)]

Attachment: code & tests

Comment 7

[Alexis Metaireau (:alexis)]

Add a way to do remote verification of the browserid assertions, and do some mocking in order to avoid the roundtrip during the tests.

Paired some bits of this with :nperriault.

Comment 8

[Adam Roach [:abr]]

Comment on attachment 8383069 [details] [review]
code & tests

Looks good, under the assumption that we'll fix the split between call-url and registration in bug 978455.

Comment 9

[Alexis Metaireau (:alexis)]

Solving with the same patch that landed in bug 971991

Comment 10

[James Bonacci [:jbonacci]]

OK. Verifying as a duplicate.