DiscoFeed and jsonp

[Brent Putman]

On 1/27/16 6:01 PM, Cantor, Scott wrote:
> On 1/27/16, 5:54 PM, "users on behalf of Janusz Ulanowski" <users-bounces at shibboleth.net on behalf of janusz.ulanowski at heanet.ie> wrote:
>
>
>
>> Thanks Scott,
>> I mean if I call 
>> https://example.com/Shibboleth.sso/DiscoFeed?callback=result
>> I would receive the result (application/javascript) wrapped in my 
>> callback function: result([.....])
> That's far beyond my Javascript, sorry.

I always forget this, usually have to look it up.  The Wikipedia page
[1] gives a good summary.

The gist is basically about allowing the request to be made by a
<script> tag, thereby bypassing the same-origin policy in effect if an
XHR did it directly.


> All I do is generate a JSON structure in the response body with the expected MIME type. I don't actually even know offhand what the EDS does to consume it.
>
>

Supporting it would probably be very easy, I think.  Whether or not
it's a good idea (security-wise, etc).... I don't know.  That's beyond
my Javascript.  I guess if it's turned off by default, and the consumer
takes responsibility for doing the right thing, then maybe it's ok. 
Maybe the main concern would be about exposing the IdP data to pages
that don't live on the SP itself...?



[1] https://en.wikipedia.org/wiki/JSONP

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/49de005b/attachment.html>