<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 1/27/16 6:01 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:6193A05C-146B-494C-8CE1-5C9B0442BCCA@osu.edu"
type="cite">
<pre wrap="">On 1/27/16, 5:54 PM, "users on behalf of Janusz Ulanowski" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofjanusz.ulanowski@heanet.ie"><users-bounces@shibboleth.net on behalf of janusz.ulanowski@heanet.ie></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Thanks Scott,
I mean if I call
<a class="moz-txt-link-freetext" href="https://example.com/Shibboleth.sso/DiscoFeed?callback=result">https://example.com/Shibboleth.sso/DiscoFeed?callback=result</a>
I would receive the result (application/javascript) wrapped in my
callback function: result([.....])
</pre>
</blockquote>
<pre wrap="">
That's far beyond my Javascript, sorry.
</pre>
</blockquote>
<br>
I always forget this, usually have to look it up. The Wikipedia
page [1] gives a good summary.<br>
<br>
The gist is basically about allowing the request to be made by a <tt><script>
</tt>tag, thereby bypassing the same-origin policy in effect if an
XHR did it directly.<br>
<br>
<br>
<blockquote cite="mid:6193A05C-146B-494C-8CE1-5C9B0442BCCA@osu.edu"
type="cite">
<pre wrap="">
All I do is generate a JSON structure in the response body with the expected MIME type. I don't actually even know offhand what the EDS does to consume it.
</pre>
</blockquote>
<br>
Supporting it would probably be very easy, I think. Whether or not
it's a good idea (security-wise, etc).... I don't know. That's
beyond my Javascript. I guess if it's turned off by default, and
the consumer takes responsibility for doing the right thing, then
maybe it's ok. Maybe the main concern would be about exposing the
IdP data to pages that don't live on the SP itself...?<br>
<br>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="https://en.wikipedia.org/wiki/JSONP">https://en.wikipedia.org/wiki/JSONP</a>
<blockquote cite="mid:6193A05C-146B-494C-8CE1-5C9B0442BCCA@osu.edu"
type="cite">
</blockquote>
<br>
</body>
</html>