doc: Document security issues involving LWP::UserAgent

[git.ikiwiki.info.git] / doc / plugins / openid.mdwn

diff --git a/doc/plugins/openid.mdwn b/doc/plugins/openid.mdwn
index 82c23fc4f6a0d6d3d4a4a8eab848c9d4f755463c..a061cb43ffd51450a3216b4e57bd40b1f5e4be82 100644 (file)
--- a/doc/plugins/openid.mdwn
+++ b/doc/plugins/openid.mdwn
@@ -7,8 +7,11 @@ into the wiki.
 The plugin needs the [[!cpan Net::OpenID::Consumer]] perl module.
 Version 1.x is needed in order for OpenID v2 to work.
 
-The [[!cpan LWPx::ParanoidAgent]] perl module is used if available, for
-added security. Finally, the [[!cpan Crypt::SSLeay]] perl module is needed
+The [[!cpan LWPx::ParanoidAgent]] Perl module is strongly recommended.
+The [[!cpan LWP]] module can also be used, but is susceptible to
+server-side request forgery.
+
+The [[!cpan Crypt::SSLeay]] Perl module is needed
 to support users entering "https" OpenID urls.
 
 This plugin is enabled by default, but can be turned off if you want to
@@ -35,3 +38,14 @@ certain setups.
 
 See [[plugins/openid/troubleshooting]] for a number of issues that may
 need to be addressed when setting up ikiwiki to accept OpenID logins reliably.
+
+## delegation
+
+This plugin does not take care of doing the "server" part of the
+OpenID protocol, only the "client" part. In other words, it allows
+users to login to your site through OpenID, but is not in itself an
+OpenID provider.
+
+It is possible, however, to use your Ikiwiki site as a delegation
+point to another OpenID provider. For this, use the
+[[ikiwiki/directive/meta/]] directive with the `openid` parameter.