diff --git a/bin/verifier b/bin/verifier index 305642f54d79e519b9dd3cfc98b46b2796f506bc..ee641c35c429e4e58d2de1dff525cbc27fb719fe 100755 --- a/bin/verifier +++ b/bin/verifier @@ -80,15 +80,6 @@ app.post('/verify', function(req, resp, next) { if (!(assertion && audience)) return resp.json({ status: "failure", reason: "need assertion and audience" }); - // FIXME: remove this eventually - resp.setHeader('Access-Control-Allow-Origin', '*'); - if (req.method === 'OPTIONS') { - resp.setHeader('Access-Control-Allow-Methods', 'POST, GET'); - resp.writeHead(200); - resp.end(); - return; - } - certassertion.verify( assertion, audience, function(email, audienceFromAssertion, expires, issuer) { diff --git a/example/index.html b/example/index.html index 2b258e7c52cd1b38a553122f52f88e82954784f8..c4f48ecc4e22d98a02c1b3c082fe33487f104fa5 100644 --- a/example/index.html +++ b/example/index.html @@ -100,7 +100,7 @@ a:hover { border-bottom: 2px solid black ; } $("#oVerificationRequest").empty().text("POST " + url + "\n" + JSON.stringify(data)); $.ajax({ - url: "https://browserid.org/verify", + url: "/process_assertion", type: "post", dataType: "json", data: data, diff --git a/scripts/serve_example.js b/scripts/serve_example.js index 904081830eca2f7392ede8c1d7434c488d402b01..7e16f58a5d067ecbce8d4a540ca51c9dc55b1182 100755 --- a/scripts/serve_example.js +++ b/scripts/serve_example.js @@ -5,11 +5,12 @@ const express = require('express'), path = require('path'), urlparse = require('urlparse'), -postprocess = require('postprocess'); +postprocess = require('postprocess'), +querystring = require('querystring'); var exampleServer = express.createServer(); -exampleServer.use(express.logger()); +exampleServer.use(express.logger({ format: 'dev' })); if (process.env['BROWSERID_URL']) { var burl = urlparse(process.env['BROWSERID_URL']).validate().normalize().originOnly().toString(); @@ -22,6 +23,56 @@ if (process.env['BROWSERID_URL']) { exampleServer.use(express.static(path.join(__dirname, "..", "example"))); +exampleServer.use(express.bodyParser()); + +exampleServer.post('/process_assertion', function(req, res, next) { + var verifier = urlparse(process.env['VERIFIER_URL']); + var meth = verifier.scheme === 'http' ? require('http') : require('https'); + + var vreq = meth.request({ + host: verifier.host, + port: verifier.port, + path: verifier.path, + method: 'POST' + }, function(vres) { + var body = ""; + vres.on('data', function(chunk) { body+=chunk; } ) + .on('end', function() { + try { + console.log(body); + var verifierResp = JSON.parse(body); + var valid = verifierResp && verifierResp.status === "okay"; + var email = valid ? verifierResp.email : null; + if (valid) { + console.log("assertion verified successfully for email:", email); + } else { + console.log("failed to verify assertion:", verifierResp.reason); + } + res.json(verifierResp); + } catch(e) { + console.log("non-JSON response from verifier"); + // bogus response from verifier! return null + res.json(null); + } + }); + }); + vreq.setHeader('Content-Type', 'application/x-www-form-urlencoded'); + + // An "audience" argument is embedded in the assertion and must match our hostname. + // Because this one server runs on multiple different domain names we just use + // the host parameter out of the request. + var audience = req.headers['host'] ? req.headers['host'] : localHostname; + var data = querystring.stringify({ + assertion: req.body.assertion, + audience: audience + }); + vreq.setHeader('Content-Length', data.length); + vreq.write(data); + vreq.end(); + console.log("verifying assertion!"); + +}); + exampleServer.listen( process.env['PORT'] || 10001, process.env['HOST'] || process.env['IP_ADDRESS'] || "127.0.0.1",