From 0a96fcf1a9febabfa3391a818c86a8948eb9914d Mon Sep 17 00:00:00 2001
From: Lloyd Hilaiel <lloyd@hilaiel.com>
Date: Thu, 21 Jul 2011 16:18:26 -0600
Subject: [PATCH] verifier now accepts parameters over POST in addition to GET,
 use of the former is preferred and user identifiable data out of http logs. 
 closes #96

---
 browserid/views/developers.ejs |  4 ++--
 rp/index.html                  | 14 ++++++++++----
 verifier/app.js                | 18 ++++++++++++------
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/browserid/views/developers.ejs b/browserid/views/developers.ejs
index 85a67d011..e4e834457 100644
--- a/browserid/views/developers.ejs
+++ b/browserid/views/developers.ejs
@@ -56,7 +56,7 @@
         free verification service provided by BrowserID.
       </p><p>
         To use it, you send a request
-        to <tt>https://browserid.org/verify</tt> with two GET parameters:
+        to <tt>https://browserid.org/verify</tt> with two POST parameters:
       </p>
         <ol>
           <li> <tt>assertion</tt>: The encoded assertion
@@ -66,7 +66,7 @@
         The verifier will check the the assertion was meant for your site and
         is valid, here's an example:
       </p>
-        <pre><code>$ curl "https://browserid.org/verify?assertion=&lt;ASSERTION&gt;&audience=mysite.com"
+        <pre><code>$ curl -d "assertion=&lt;ASSERTION&gt;&audience=mysite.com" "https://browserid.org/verify"
 {
     "status": "okay",
     "email": "lloyd@mozilla.com",
diff --git a/rp/index.html b/rp/index.html
index be382ce9a..53fd47c1e 100644
--- a/rp/index.html
+++ b/rp/index.html
@@ -90,13 +90,19 @@ a:hover { border-bottom: 2px solid black ; }
           // Now we'll send this assertion over to the verification server for validation
           $("#oAssertion").empty().text(assertion);
 
-          var url = "https://browserid.org/verify?assertion=" + window.encodeURIComponent(assertion) +
-                    "&audience=" + window.encodeURIComponent(window.location.host);
-          $("#oVerificationRequest").empty().text(url);
+          var url = "https://browserid.org/verify"
+          var data = {
+            assertion: assertion,
+            audience: window.location.host
+          };
+
+          $("#oVerificationRequest").empty().text("POST " + url + "\n" + JSON.stringify(data));
 
           $.ajax({
-            url: url,
+            url: "https://browserid.org/verify",
+            type: "POST",
             dataType: "json",
+            data: data,
             success: function(data, textStatus, jqXHR) {
               $("#oVerificationResponse > pre").empty().text(JSON.stringify(data, null, 4));
             },
diff --git a/verifier/app.js b/verifier/app.js
index cf5833ec6..4fbd67b20 100644
--- a/verifier/app.js
+++ b/verifier/app.js
@@ -3,31 +3,32 @@ const   path = require('path'),
           fs = require('fs'),
    httputils = require('./lib/httputils.js'),
  idassertion = require('./lib/idassertion.js'),
-         jwt = require('./lib/jwt.js');
+         jwt = require('./lib/jwt.js'),
+     express = require('express');
 
 // create the var directory if it doesn't exist
 var VAR_DIR = path.join(__dirname, "var");
 try { fs.mkdirSync(VAR_DIR, 0755); } catch(e) { }
 
 function doVerify(req, resp, next) {
-  var assertion = req.query.assertion;
-  var audience = req.query.audience;
+  var assertion = (req.query && req.query.assertion) ? req.query.assertion : req.body.assertion;
+  var audience = (req.query && req.query.audience) ? req.query.audience : req.body.audience;
 
   if (!(assertion && audience))
     return httputils.jsonResponse(resp, {status:"failure", reason:"need assertion and audience"});
-  
+
   // allow client side XHR to access this WSAPI, see
   // https://developer.mozilla.org/en/http_access_control
   // for details
   // FIXME: should we really allow this? It might encourage the wrong behavior
   resp.setHeader('Access-Control-Allow-Origin', '*');
   if (req.method === 'OPTIONS') {
-    resp.setHeader('Access-Control-Allow-Methods', 'GET');
+    resp.setHeader('Access-Control-Allow-Methods', 'POST, GET');
     resp.writeHead(200);
     resp.end();
     return;
   }
-  
+
   try {
     var assertionObj = new idassertion.IDAssertion(assertion);
     assertionObj
@@ -56,6 +57,8 @@ function doVerify(req, resp, next) {
 exports.varDir = VAR_DIR;
 
 exports.setup = function(app) {
+  app.use(express.bodyParser());
+
   // code_update is an internal api that causes the node server to
   // shut down.  This should never be externally accessible and
   // is used during the dead simple deployment procedure.
@@ -73,4 +76,7 @@ exports.setup = function(app) {
 
   app.get('/', doVerify);
   app.get('/verify', doVerify);
+
+  app.post('/', doVerify);
+  app.post('/verify', doVerify);
 };
-- 
GitLab