RelMeAuth - Revision history

GRegorLove: s///

2023-07-26T21:36:11Z

s/<source>/<syntaxhighlight>/

← Older revision		Revision as of 21:36, 26 July 2023
Line 36:		Line 36:

	Tantek's home page http://tantek.com/ has (simplified markup)		Tantek's home page http://tantek.com/ has (simplified markup)
	<~~source~~ lang=~~html4strict~~>		<syntaxhighlight lang="html">
	<ul>		<ul>
	<li><a rel="me" href="http://twitter.com/t">Twitter: @t</a></li>		<li><a rel="me" href="http://twitter.com/t">Twitter: @t</a></li>
	<li><a rel="me" href="http://identi.ca/t">identi.ca: t</a></li>		<li><a rel="me" href="http://identi.ca/t">identi.ca: t</a></li>
	</ul>		</ul>
	</~~source~~>		</syntaxhighlight>

	=== users with separate contact pages ===		=== users with separate contact pages ===
Line 57:		Line 57:

	Jeremy Keith's home page http://adactio.com/ has (simplified markup)		Jeremy Keith's home page http://adactio.com/ has (simplified markup)
	<~~source~~ lang=~~html4strict~~>		<syntaxhighlight lang="html">
	<ul>		<ul>
	<li><a rel="me" href="/journal/">Journal</a></li>		<li><a rel="me" href="/journal/">Journal</a></li>
	<li><a rel="me" href="/contact/">Contact</a></li>		<li><a rel="me" href="/contact/">Contact</a></li>
	</ul>		</ul>
	</~~source~~>		</syntaxhighlight>

	and then also:		and then also:

	http://adactio.com/journal/ has (simplified markup)		http://adactio.com/journal/ has (simplified markup)
	<~~source~~ lang=~~html4strict~~>		<syntaxhighlight lang="html">
	<ul>		<ul>
	<li><a rel="me" href="http://huffduffer.com/adactio/">Huffduffer</a></li>		<li><a rel="me" href="http://huffduffer.com/adactio/">Huffduffer</a></li>
Line 79:		Line 79:
	<li><a rel="me" href="http://97bottles.com/people/adactio/">97 Bottles</a></li>		<li><a rel="me" href="http://97bottles.com/people/adactio/">97 Bottles</a></li>
	</ul>		</ul>
	</~~source~~>		</syntaxhighlight>

	==== authentication preference ====		==== authentication preference ====

GRegorLove: /* PHP */ site themattharris.com appears to be dead

2022-09-15T20:15:05Z

PHP: site themattharris.com appears to be dead

← Older revision		Revision as of 20:15, 15 September 2022
Line 204:		Line 204:
	** Live demo sites:		** Live demo sites:
	*** http://tantek.com/relmeauth/		*** http://tantek.com/relmeauth/
	*** http://apps.themattharris.com/relmeauth/		*** http://apps.themattharris.com/relmeauth/ (2022-09-15: site appears to be dead)

	=== Ruby ===		=== Ruby ===

GRegorLove: /* open source implementations */ +Go,Node, updated indieauth.com repo

2022-09-15T20:11:57Z

open source implementations: +Go,Node, updated indieauth.com repo

← Older revision		Revision as of 20:11, 15 September 2022
Line 188:		Line 188:
	== open source implementations ==		== open source implementations ==
	There are a couple of open source libraries that sites can use to implement RelMeAuth so their users can login using their own identities.		There are a couple of open source libraries that sites can use to implement RelMeAuth so their users can login using their own identities.

			=== Go ===
			* https://github.com/hawx/relme-auth
			** Live demo site: https://auth.hawx.me/

			=== Node.js ===
			* https://www.npmjs.com/package/relmeauth
			* https://github.com/superfeedr/node-relmeauth

	=== Python ===		=== Python ===
Line 199:		Line 207:

	=== Ruby ===		=== Ruby ===
	* [https://github.com/aaronpk/IndieAuth IndieAuth] by Aaron Parecki contains Ruby code for performing RelMeAuth authentication~~, but is currently integrated into the indieauth.com code in general~~		* [https://github.com/aaronpk/IndieAuth.com IndieAuth.com] (deprecated) by Aaron Parecki contains Ruby code for performing RelMeAuth authentication
	** To Do: Separate Ruby gem for Ruby implementation of RelMeAuth		** To Do: Separate Ruby gem for Ruby implementation of RelMeAuth

Tantek: /* detailed algorithm */ check for IndieAuth before performing rel-me discovery (because no one implemented checking a user's own site for OAuth, also OAuth lacked sufficient discovery mechanisms to implement that), explicit should reject silo profiles, may accept 1-2 for testing/demo purposes

2021-04-07T21:04:58Z

detailed algorithm: check for IndieAuth before performing rel-me discovery (because no one implemented checking a user's own site for OAuth, also OAuth lacked sufficient discovery mechanisms to implement that), explicit should reject silo profiles, may accept 1-2 for testing/demo purposes

← Older revision		Revision as of 21:04, 7 April 2021
Line 146:		Line 146:

	# start with a user identity URL (e.g from the UI, or from a cookie from previous login etc.)		# start with a user identity URL (e.g from the UI, or from a cookie from previous login etc.)
	# if the URL is an ~~OAuth~~ provider		## if the identity URL is not user-owned (i.e. at a known silo domain),
			## then
			### the implementation should not accept it, and await user correction of the URL
			### the implementation may accept 1-2 silo domains for testing or demonstration purposes
			# if the URL is an IndieAuth provider
	# then try authenticating with it (we prefer the user's own site for auth)		# then try authenticating with it (we prefer the user's own site for auth)
	## if it succeeds, exit		## if it succeeds, exit

Uo: spam

2015-01-14T05:00:10Z

spam

Show changes

Ainecoco at 08:49, 8 January 2015

2015-01-08T08:49:01Z

Show changes

Barnabywalters: /* Error Cases */ stubbed reverse rel me link insecure redirect

2013-10-08T11:57:01Z

Error Cases: stubbed reverse rel me link insecure redirect

← Older revision		Revision as of 11:57, 8 October 2013
Line 170:		Line 170:
	'''The rel-me-url redirect chain includes a redirect where the scheme changes'''		'''The rel-me-url redirect chain includes a redirect where the scheme changes'''
	* Example: http://brennannovak.com redirects to https://brennannovak.com		* Example: http://brennannovak.com redirects to https://brennannovak.com
	* Why is this a problem?		* Why is this a problem? … explain vulnerabilities for both directions here
	* What message should be presented to the user? Two cases:		* What message should be presented to the user? Two cases:
	** If the insecure redirect only changed the scheme (as in the above example), tell them that they need to enter the https:// version of the URL		** If the insecure redirect only changed the scheme (as in the above example), tell them that they need to enter the https:// version of the URL
Line 176:		Line 176:
	*** What warning to give if a https:// URL redirects to a http:// URL? --[[User:Barnabywalters\|bw]] 10:16, 8 October 2013 (UTC)		*** What warning to give if a https:// URL redirects to a http:// URL? --[[User:Barnabywalters\|bw]] 10:16, 8 October 2013 (UTC)
	** Otherwise, let them know there was an insecure redirect, as well as what it was. Bonus: explain how MITM attacks work and why they’re dangerous		** Otherwise, let them know there was an insecure redirect, as well as what it was. Bonus: explain how MITM attacks work and why they’re dangerous

			'''A reverse rel-me link’s redirect chain includes a redirect where the scheme changes'''
			* Example: …
			* Why is this a problem? …
			* What message should be presented to the user?

	== open source implementations ==		== open source implementations ==

Barnabywalters: /* Error Cases */ Added rel-me-url insecure redirect error case, with questions

2013-10-08T10:16:14Z

Error Cases: Added rel-me-url insecure redirect error case, with questions

← Older revision		Revision as of 10:16, 8 October 2013
Line 166:		Line 166:
	Document things which can go wrong during the relmeauth process along with real world examples and what message should be shown to the end user to help them fix it.		Document things which can go wrong during the relmeauth process along with real world examples and what message should be shown to the end user to help them fix it.

	* …		Let '''rel-me-url''' be the URL given by the user.

			'''The rel-me-url redirect chain includes a redirect where the scheme changes'''
			* Example: http://brennannovak.com redirects to https://brennannovak.com
			* Why is this a problem?
			* What message should be presented to the user? Two cases:
			** If the insecure redirect only changed the scheme (as in the above example), tell them that they need to enter the https:// version of the URL
			*** Would it be acceptable to automatically restart the process using the secure URL? --[[User:Barnabywalters\|bw]] 10:16, 8 October 2013 (UTC)
			*** What warning to give if a https:// URL redirects to a http:// URL? --[[User:Barnabywalters\|bw]] 10:16, 8 October 2013 (UTC)
			** Otherwise, let them know there was an insecure redirect, as well as what it was. Bonus: explain how MITM attacks work and why they’re dangerous

	== open source implementations ==		== open source implementations ==

Barnabywalters: /* how it works */ added error cases stub

2013-10-07T21:46:08Z

how it works: added error cases stub

← Older revision		Revision as of 21:46, 7 October 2013
Line 161:		Line 161:
	## continue iteration with the next rel-me link if any		## continue iteration with the next rel-me link if any
	# no authenticatable URLs found (either none at all, or any provided had some other error, 404, no response, no OAuth endpoint, other OAuth error)		# no authenticatable URLs found (either none at all, or any provided had some other error, 404, no response, no OAuth endpoint, other OAuth error)

			== Error Cases ==

			Document things which can go wrong during the relmeauth process along with real world examples and what message should be shown to the end user to help them fix it.

			* …

	== open source implementations ==		== open source implementations ==

Barnabywalters: /* how it works */

2013-10-05T18:24:41Z

how it works

← Older revision		Revision as of 18:24, 5 October 2013
Line 140:		Line 140:

	=== detailed algorithm ===		=== detailed algorithm ===
			{{main\|relmeauth-algorithms}}

	* input: a user identity (URL) to authenticate		* input: a user identity (URL) to authenticate
	* output: success or cancel authentication or no authenticatable URLs found		* output: success or cancel authentication or no authenticatable URLs found