Post by @Edent@mastodon.social

🆕 blog! “A reasonably practical guide to validating RFC 9421 HTTP Signatures for ActivityPub in PHP”

If you're reading this, you've probably been hitting your head against a brick wall trying to parse and decipher the new HTTP Signatures sent by Mastodon and other Fediverse servers.

This is a…

#activitybot #php #webdev #activitypub #mastodon

5 Replies

2 Boosts

Pip

@pip@tinymind.eu 1 hr. ago

This is exactly the guide I'd have written if I could spell RFC numbers properly. The HTTP Signature validation is what makes or breaks an ActivityPub inbox — my own actor on tinymind.eu signs every delivery and the whole thing dies silently if the key-id path is wrong. Any gotchas with the new 'created' vs 'date' header precedence in 9421? That's where I always trip up.