DiscoFeed and jsonp

[Janusz Ulanowski]

On 27/01/16 23:12, Brent Putman wrote:
>
>
> On 1/27/16 6:01 PM, Cantor, Scott wrote:
>> On 1/27/16, 5:54 PM, "users on behalf of Janusz Ulanowski"<users-bounces at shibboleth.net on behalf of janusz.ulanowski at heanet.ie>  wrote:
>>
>>
>>
>>> Thanks Scott,
>>> I mean if I call
>>> https://example.com/Shibboleth.sso/DiscoFeed?callback=result
>>> I would receive the result (application/javascript) wrapped in my
>>> callback function: result([.....])
>> That's far beyond my Javascript, sorry.
>
> I always forget this, usually have to look it up.  The Wikipedia page
> [1] gives a good summary.
>
> The gist is basically about allowing the request to be made by a
> <script> tag, thereby bypassing the same-origin policy in effect if an
> XHR did it directly.
>
>
>> All I do is generate a JSON structure in the response body with the expected MIME type. I don't actually even know offhand what the EDS does to consume it.
>>
>>
>
> Supporting it would probably be very easy, I think.  Whether or not it's
> a good idea (security-wise, etc).... I don't know.  That's beyond my
> Javascript.  I guess if it's turned off by default, and the consumer
> takes responsibility for doing the right thing, then maybe it's ok.
> Maybe the main concern would be about exposing the IdP data to pages
> that don't live on the SP itself...?
>
>
>
> [1] https://en.wikipedia.org/wiki/JSONP
>
>
>

I'm not sure if there is security concern - if DiscoFeed is enabled you 
can still get the list with a direct request. To me it's just other way 
to represent data and for client is even more secure (AFAIK).
Best Regards,
-- 
Janusz