RFC 9421 Testing endpoints?
-
@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.
-
@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.
@mradcliffe@nokoto.org if your software is open, I (or rather, my local AI <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f633.png?v=f52195b43b7" title="
" />) can do a deep dive.@silverpill@mitra.social my laptop says the timeout is due to Mitra's 10s timeout (this may be incorrect), and to try again <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f914.png?v=f52195b43b7" title="
" /> activitypub.spaceis slow, it's hit by many scrapers and a 10+s response is not out of the ordinary. -
@julian Thank you. Unfortunately, it's not open... Yet. I am working on trying to split out what makes nokoto.org unique.
I know that I get RFC9421 successes from Gush at least.
-
It works now, this time the response was quick (200 OK)
-
It works now, this time the response was quick (200 OK)
@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include
algparameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assumersa-v1_5-sha256if it’s missing. I know that’s not great, but maybe we should all just agree to includealg?I guess @Edent feels the same way.
-
@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.
If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends. -
@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include
algparameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assumersa-v1_5-sha256if it’s missing. I know that’s not great, but maybe we should all just agree to includealg?I guess @Edent feels the same way.
@mradcliffe @julian @Edent Agreed - my implementation adds the
algparameter.But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.
https://portswigger.net/web-security/jwt/algorithm-confusion
-
@mradcliffe @julian @Edent Agreed - my implementation adds the
algparameter.But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.
https://portswigger.net/web-security/jwt/algorithm-confusion
Thanks both!
I'll look into adding the
algparameter and circle back. -
If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.@Edent just tried to DM it from Loops and it doesn't recognize the account
-
If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.@edent@mastodon.social okay. Hello @example@example.viii.fi !
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login