Comment 52 for bug 1169

Revision history for this message
James Henstridge (jamesh) wrote :

OpenID relying parties do follow redirects, but not in a way that helps here.

Say you used http://example.com/bob/ as your OpenID. Each site you logged in to would record this URL as your user identifier.

Now lets say you decided to use http://example.com/robert/ instead so set up a redirect from the first to the second. Now when you log in this new URL will be recorded. Furthermore, the redirect means that if you enter the old URL the new one would be recorded. This effectively cuts you off from accounts on sites you used before setting up the redirect.

Things will work if you redirect from the new URL to the old URL, but that is probably not what you want: if sites display your OpenID, it will show the old URL.