Once again doing battle with http signatures.
They work when I POST, but fail to be validated when I GET.
I'm sure there's a simple explanation...
7
Replies
1
Boost
So, if I've got this right about HTTP Signatures.
➡ You send me a request.
🔍 I check the digest matches the contents.
📆 I check the date is roughly correct.
⬅ I request your public key.
🖊 That requires me to sign a request with my private key.
🔑 I get your public key.
🕵 I validate your request by checking the signature matches the entire request - including digest.
But…! When I request your public key, you have to validate my public key. Which leads us into a loop?
Even more HTTP Message Signature weirdness.
My server receives a lot of "Delete" requests from #Mastodon server.
Those requests are signed.
I try to validate the signature but… the user is deleted!
So I try to retrieve the user's Public Key at, for example, https://nrw.social/@Faxy.json#main-key but get an error.
I suppose an HTTP 410 is a pretty good indication that the user has been deleted. And I *might* have previously cached the key. But it does feel a *little* bit pointless.
2 years later
Hmmmm. Some #ActivityPub headers have:
digest => sha-256=…
But others have
content-digest => sha-256=…
Looks like I need to update my code, and a bunch of tutorials need to update their documentation!
OK! Today I'm going to attempt battle with RFC9421 HTTP Signatures.
Just validating them - I'm not brave enough to send them yet 😆
