<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi everyone,<br>
<br>
I'm experimenting with a self-hosted Firefox syncserver and auth
server stack, which is working fine so far. I wonder, however, how
the syncserver verifies the account assertions it gets from the
browser / auth server. As I have not configured any
auth-server-related information in the syncserver.ini, I doubt there
is any verification at all - is that correct? Does that mean the
syncserver trusts assertions created by _any_ auth server, not just
the one I am hosting? If so, how can I restrict the verification in
such a way that only assertions from my own auth server will be
accepted?<br>
<br>
Note: I am using a local BrowserID verifier, configured in
syncserver.ini as follows:<br>
<br>
[browserid]
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">backend =
tokenserver.verifiers.LocalVerifier</p>
<p style=" margin-top:0px; margin-bottom:0px; margin-left:0px;
margin-right:0px; -qt-block-indent:0; text-indent:0px;">audiences
= <a class="moz-txt-link-freetext" href="https://">https://</a><my-syncserver-url></p>
<p style="-qt-paragraph-type:empty; margin-top:0px;
margin-bottom:0px; margin-left:0px; margin-right:0px;
-qt-block-indent:0; text-indent:0px;"><br>
</p>
<p style="-qt-paragraph-type:empty; margin-top:0px;
margin-bottom:0px; margin-left:0px; margin-right:0px;
-qt-block-indent:0; text-indent:0px;">Kind regards</p>
<p style="-qt-paragraph-type:empty; margin-top:0px;
margin-bottom:0px; margin-left:0px; margin-right:0px;
-qt-block-indent:0; text-indent:0px;">Nikolaus<br>
</p>
</body>
</html>