Verifying Browserid Assertions in JavaScript with Web Cryptography API

149 views Asked by At

Will the additions to JavaScript runtime environment in the web browser proposed in the Web Cryptography API allow us to securely verify browserid assertions in the browser with JavaScript?

1

There are 1 answers

1
François Marier On BEST ANSWER

You could already verify BrowserID assertions client-side in Javascript, but the problem is that you can't trust the client.

A user could for example run your code through a proxy server which alters the Javascript to always claim that assertions are valid. Unless you're doing server-side verification, your server code will be vulnerable to clients claiming that everything is fine when in fact the assertion is bogus.

No browser API will change the fact that as far as the server is concerned, you cannot rely on the client doing the right thing. The server needs to do that verification itself.