Ticket #3823 (closed enhancement: fixed)

Opened 3 years ago

Last modified 3 years ago

OpenID field should be named openid_url on OpenStreetMap.org

Reported by: SamatJain Owned by: tom@…
Priority: minor Milestone:
Component: website Version:
Keywords: OpenID Cc: Axel.Nennker@…

Description

Submitting a bug on behalf of @AxelNennker?, e-mail from him:

Currently openstreetmap has this code:  https://www.openstreetmap.org/user/new <tr id="openid_url">

<td class="fieldName"><img alt="Log in with an OpenID" class="openid_logo" src="/images/openid_small.png?1307739368" /> OpenID:</td> <td><input class="openid_url" id="user_openid_url" maxlength="255" name="user[openid_url]" size="50" tabindex="4" type="text" /></td>

</tr>

Could you please change this to: <tr id="tr_openid_url">

<td class="fieldName"><img alt="Log in with an OpenID" class="openid_logo" src="/images/openid_small.png?1307739368" /> OpenID:</td> <td><input class="openid_url" id="openid_url" maxlength="255" name="openid_url" size="50" tabindex="4" type="text" /></td>

</tr>

The reason for my request is that I have built a Firefox extension that helps the user to use their openid. Verisign have build a browser extension too. These extensions parse the html code and try to find the openid input field by searching for "openid_url". The current code at openstreetmap does not match the addons' expections. (I could call it OC best practices but I currently can not find the best practices document that recommends to use the name openid_url for the input field...) I know that this change requires to change the server code too.

 https://addons.mozilla.org/en-US/firefox/addon/openid-for-firefox/  https://pip.verisignlabs.com/seatbelt.do  https://addons.mozilla.org/en-US/firefox/addon/openid-login/

 http://developer.yahoo.com/openid/bestpractices.html  http://wiki.openid.net/w/page/12995223/Relying-Party-Best-Practices

The OpenID 1.1 spec (§3.2.1) mentions that form fields that take OpenID URLs are RECOMMENDED to be named openid_url:

 http://openid.net/specs/openid-authentication-1_1.html#anchor6

Change History

comment:1 Changed 3 years ago by TomH

Changing the name isn't really very easy because the name is dictated by the automatic form handling in the application platform we use.

I mean we could do it, but then we would have to process that field manually instead of having it taken care of automatically, so I am somewhat reluctant to make the change.

Frankly for third parties to rely on the field having a particular name is just batshit crazy - it would have been far better to say that any field of a particular class would be considered to be an OpenID URL.

comment:2 Changed 3 years ago by axel@…

Well, the third party in this case is the form-fill component in the browser. Form-fillers look for the id and/or name of the input field. So if all OpenID consumers use the same name/id then the openid can be filled in by the browser; even if the user visits a site for the first time. So I think this does make sense. Using the class attribute would be OK for browser extensions but not for the currently deployed form-fillers.

I suggest the following change: Change the id of the input field to openid_url but not the value of the name attribute. Change the id of the tr to prevent id clashes.

<tr id="tr_openid_url">

<td class="fieldName"><img alt="Log in with an OpenID"

class="openid_logo" src="/images/openid_small.png?1307739368" /> OpenID:</td>

<td><input class="openid_url" id="openid_url" maxlength="255"

name="user[openid_url]" size="50" tabindex="4" type="text" /></td>

</tr>

This would allow you to keep the server code as is.

-Axel

comment:3 Changed 3 years ago by TomH

  • Status changed from new to closed
  • Resolution set to fixed

I've changed this as you suggest, and it should be live in the next half hour.

Note: See TracTickets for help on using tickets.