Opened 4 years ago

Closed 4 years ago

#3823 closed enhancement (fixed)

OpenID field should be named openid_url on OpenStreetMap.org

Reported by: SamatJain Owned by: tom@…
Priority: minor Milestone:
Component: website Version:
Keywords: OpenID Cc: Axel.Nennker@…

Description

Submitting a bug on behalf of @AxelNennker?, e-mail from him:

Currently openstreetmap has this code: https://www.openstreetmap.org/user/new
<tr id="openid_url">

<td class="fieldName"><img alt="Log in with an OpenID" class="openid_logo" src="/images/openid_small.png?1307739368" /> OpenID:</td>
<td><input class="openid_url" id="user_openid_url" maxlength="255" name="user[openid_url]" size="50" tabindex="4" type="text" /></td>

</tr>


Could you please change this to:
<tr id="tr_openid_url">

<td class="fieldName"><img alt="Log in with an OpenID" class="openid_logo" src="/images/openid_small.png?1307739368" /> OpenID:</td>
<td><input class="openid_url" id="openid_url" maxlength="255" name="openid_url" size="50" tabindex="4" type="text" /></td>

</tr>


The reason for my request is that I have built a Firefox extension that helps the user to use their openid.
Verisign have build a browser extension too.
These extensions parse the html code and try to find the openid input field by searching for "openid_url".
The current code at openstreetmap does not match the addons' expections. (I could call it OC best practices but I currently can not find the best practices document that recommends to use the name openid_url for the input field...) I know that this change requires to change the server code too.


https://addons.mozilla.org/en-US/firefox/addon/openid-for-firefox/
https://pip.verisignlabs.com/seatbelt.do
https://addons.mozilla.org/en-US/firefox/addon/openid-login/



http://developer.yahoo.com/openid/bestpractices.html
http://wiki.openid.net/w/page/12995223/Relying-Party-Best-Practices

The OpenID 1.1 spec (§3.2.1) mentions that form fields that take OpenID URLs are RECOMMENDED to be named openid_url:

http://openid.net/specs/openid-authentication-1_1.html#anchor6

Change History (3)

comment:1 Changed 4 years ago by TomH

Changing the name isn't really very easy because the name is dictated by the automatic form handling in the application platform we use.

I mean we could do it, but then we would have to process that field manually instead of having it taken care of automatically, so I am somewhat reluctant to make the change.

Frankly for third parties to rely on the field having a particular name is just batshit crazy - it would have been far better to say that any field of a particular class would be considered to be an OpenID URL.

comment:2 Changed 4 years ago by axel@…

Well, the third party in this case is the form-fill component in the browser.
Form-fillers look for the id and/or name of the input field.
So if all OpenID consumers use the same name/id then the openid can be filled in by the browser; even if the user visits a site for the first time.
So I think this does make sense. Using the class attribute would be OK for browser extensions but not for the currently deployed form-fillers.

I suggest the following change:
Change the id of the input field to openid_url but not the value of the name attribute.
Change the id of the tr to prevent id clashes.

<tr id="tr_openid_url">

<td class="fieldName"><img alt="Log in with an OpenID"

class="openid_logo" src="/images/openid_small.png?1307739368" />
OpenID:</td>

<td><input class="openid_url" id="openid_url" maxlength="255"

name="user[openid_url]" size="50" tabindex="4" type="text" /></td>

</tr>

This would allow you to keep the server code as is.

-Axel

comment:3 Changed 4 years ago by TomH

  • Resolution set to fixed
  • Status changed from new to closed

I've changed this as you suggest, and it should be live in the next half hour.

Note: See TracTickets for help on using tickets.