I agree. That sounds like a good OpenID 2.1 spec enhancement.<br clear="all"><br>Andrew Arnott
<br><br><div class="gmail_quote">On Wed, Jun 11, 2008 at 5:15 PM, Jonathan Daugherty <<a href="mailto:cygnus@janrain.com">cygnus@janrain.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">> Again, I agree that OPs shouldn't, but the<br>
> spec doesn't disallow it,<br>
<br>
</div>It's true that the spec doesn't address the unsolicited assertion<br>
response case, but section 10.1., Positive Assertions, *does* say that<br>
the return_to in the response is a "verbatim copy of the return_to URL<br>
parameter sent in the request."<br>
<br>
So a MUST might help clarify this since it is a little hidden.<br>
<br>
--<br>
<font color="#888888"> Jonathan Daugherty<br>
</font><div><div></div><div class="Wj3C7c"><br>
_______________________________________________<br>
Dev mailing list<br>
<a href="mailto:Dev@lists.openidenabled.com">Dev@lists.openidenabled.com</a><br>
<a href="http://lists.openidenabled.com/mailman/listinfo/dev" target="_blank">http://lists.openidenabled.com/mailman/listinfo/dev</a><br>
</div></div></blockquote></div><br>