intertwingly

It’s just data

Optional Elements Required


Anne van Kesteren: The problem here is that OpenID does not use a proper HTML parser (not even one that follows the HTML 4 specification). <head> et cetera are actually required

The spec isn’t as clear as it ought to be.  From the OpenID Authentication 1.1 § 3.1:

In order for a Consumer to know the Identity Provider authoritative for an Identifier, the End User must add markup to the HEAD section of the HTML document located at their URL.

FWIW, I have a similar issue with the fact that the specs don’t distinguish between temporary and permanent redirects.  From § 3.2.1:

Consumers MUST canonicalize the Identifier URL, following redirects, and note the final URL. The final, canonicalized URL is the End User’s Identifier.