Google Apps host meta discovery fails when RequireSsl is turned on about dotnetopenauth HOT 4 OPEN

Hi Andrew, was this fixed or is there a work around? I updated to the latest version and cannot use RequireSSL in my web.config for my Google Apps implementation.

With the DotNetOpenAuth.OpenId.RelyingParty.OpenIdTextBox control, I get this error if I turn RequireSSL to on:

{DotNetOpenAuth.Messaging.ProtocolException: 
Sorry.  This site only accepts OpenIDs that are HTTPS-secured, but 
http://gaschool.scolab.com/openid?id=116298317018479467791 is not a secure Identifier." 
at DotNetOpenAuth.Messaging.ErrorUtilities.VerifyProtocol(Boolean condition, String message, Object[] args)
at DotNetOpenAuth.Messaging.ErrorUtilities.ThrowProtocol(String message, Object[] args)
at DotNetOpenAuth.OpenId.RelyingParty.PositiveAuthenticationResponse.VerifyDiscoveryMatchesAssertion(OpenIdRelyingParty relyingParty)
at DotNetOpenAuth.OpenId.RelyingParty.PositiveAuthenticationResponse..ctor(PositiveAssertionResponse response, OpenIdRelyingParty relyingParty)
at DotNetOpenAuth.OpenId.RelyingParty.OpenIdRelyingParty.GetResponse(HttpRequestInfo httpRequestInfo)}

Does this mean I have content going over an insecure channel, or just that I do not enforce such behavior?

Thanks a lot, keep the good work!
Carl

from dotnetopenauth.

No, this hasn't been fixed yet.

from dotnetopenauth.

Thanks for the update. Can you tell me the security implication of turning RequireSSL to off?

Does this mean I have content going over an insecure channel, or just that I do not enforce such behavior?

Thanks!
Carl

from dotnetopenauth.

RequireSsl=false does not mean that SSL will not be used. It merely means that DNOA will permit use of non-SSL channels if such channels are either the only option, or according to XRDS discovery considered to be the preferred option.
RequireSsl=true guarantees that only SSL channels will be used. If your only discovery module is the HostMetaDiscoveryService one (you've removed the normal one) then you may already be set to go. If I recall correctly, the HTTPS URLs are already hard-coded, so RequireSsl=true may not offer anything new to you. Not certain, this is from memory.

from dotnetopenauth.