Should I cache the XRDS file returned in openid?

Question

In the initial part of the openid sequence, I request the OP (e.g. Yahoo.com) and get back the XRDS file which tells me the actual URL I need to use for the rest of the openid process. So, can I cache this initial file. E.g. if I have hundreds of users using a Yahoo openid, I would only have to do the initial fetch once every hour?

Answer 1

Yes, the OpenID spec does not forbid discovery caching, and most OpenID-enabled sites do just that. Of course the duration you cache discovery results should be balanced between speed, memory consumption and stale data.