CODEWITHSUNDEEP
pythonopenid
Timmy
Timmy

Reputation: 12848

Check secure OpenID redirect?

The process for openid login for my server redirects to google, for example, then google redirects back to a page with parameters in the parameter string. how do I verify this really came from google?

Upvotes: 0

Views: 147

Answers (1)

ʇsәɹoɈ
ʇsәɹoɈ

Reputation: 23509

Those parameters probably contain an OpenID assertion (or an error). You can verify the assertion by following the instructions in the OpenID spec:

http://openid.net/specs/openid-authentication-2_0.html#verification

You probably don't want to do all the work yourself, though, since it's a bit complicated. The Janrain OpenID library for python can simplify the process somewhat:

http://www.janrain.com/openid-enabled

To make things even simpler, find an OpenID plugin for your web framework. Here is one for Flask:

http://packages.python.org/Flask-OpenID/

Upvotes: 1

Related Questions