<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello Shane,<br>
<br>
We should check with the guys from browser.html they plan to use FxA
with Kinto during this Q3 and I remember we talked about iframe for
this. (With Paul Rouget)<br>
<br>
Regards,<br>
<br>
Rémy<br>
<br>
<br>
<div class="moz-cite-prefix">Le 02/07/2015 16:59, Shane Tomlinson a
écrit :<br>
</div>
<blockquote
cite="mid:CAO07_nDrXCqotM1fL6GM-aO2QDV8XxcxbDFQC_UfN=y0zAS9kg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>I propose we remove iframe support for OAuth reliers.<br>
</div>
<div><br>
We currently allow OAuth reliers and the upcoming
firstrun flow to iframe FxA. Iframe support was added to
allow Marketplace to embed FxA in-content.<br>
<br>
Some fairly byzantine client-side checks are performed
to ensure we aren't opening users up to phishing
attacks. Those checks are complex, and honestly, pretty
gross. <br>
<br>
Ryan Kelly asked a good question - if no OAuth reliers
currently ifram FxA, why do we even offer the
functionality?<br>
</div>
<br>
</div>
Marketplace was able to integrate FxA without using an
iframe. No other OAuth reliers that I know of use the
iframe. I'd like to rip out OAuth relier iframe support and
reduce the possible attack surface area.<br>
<br>
</div>
Without iframe support, could simplify the content server,
123done (a test relier), and the fxa-relier-client.<br>
<br>
Note, iframe support would still be available for the first
run flow, no changes there.<br>
<br>
</div>
<div>Andy and Stuart, this would primarily affect you. Does
anybody else know of an OAuth relier that iframes FxA?<br>
</div>
<div><br>
</div>
Shane<br>
<br>
------------------------<br>
<div>
<div>
<div>
<div><br>
[1] - <a moz-do-not-send="true"
href="https://tools.ietf.org/html/rfc7034#section-2.1">https://tools.ietf.org/html/rfc7034#section-2.1</a><br>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Dev-fxacct mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/dev-fxacct">https://mail.mozilla.org/listinfo/dev-fxacct</a>
</pre>
</blockquote>
<br>
</body>
</html>