<![CDATA[RFC 9421 Testing endpoints?]]>Is there a service or implementation that can test RFC 9421 implementations? I'm running a branch of NodeBB here on activitypub.space that sends and receives RFC 9421 HTTP Signatures and I'd like to test against someone <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f603.png?v=f52195b43b7" title=":smiley:" />

@silverpill@mitra.social perhaps?

]]>https://forum.pierobosio.it/topic/1939236a-e7d2-489c-822b-1020eaff05c3/rfc-9421-testing-endpointsRSS for NodeSun, 20 Sep 2026 17:12:51 GMTFri, 28 Aug 2026 21:17:58 GMT60<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 13:57:51 GMT]]>@julian Feel free to abuse @actor@didkey.000090000.xyz or @dimkr@didkey.000090000.xyz

]]>https://forum.pierobosio.it/post/https://didkey.000090000.xyz/.well-known/apgateway/did:key:z6MkoQhyST3stSA687x4jMq8Rc59cBD7FLeXs9p1MXQuQqYD/actor/post/01a04dcf-fd70-7f8a-a1ea-2d48a57a1f7ahttps://forum.pierobosio.it/post/https://didkey.000090000.xyz/.well-known/apgateway/did:key:z6MkoQhyST3stSA687x4jMq8Rc59cBD7FLeXs9p1MXQuQqYD/actor/post/01a04dcf-fd70-7f8a-a1ea-2d48a57a1f7aSat, 29 Aug 2026 13:57:51 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 13:37:29 GMT]]>@edent@mastodon.social okay. Hello @example@example.viii.fi !

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2406https://forum.pierobosio.it/post/https://activitypub.space/post/2406Sat, 29 Aug 2026 13:37:29 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 13:24:07 GMT]]>@Edent just tried to DM it from Loops and it doesn't recognize the account

]]>https://forum.pierobosio.it/post/https://social.wake.st/users/liaizon/statuses/117179013374908609https://forum.pierobosio.it/post/https://social.wake.st/users/liaizon/statuses/117179013374908609Sat, 29 Aug 2026 13:24:07 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 13:12:53 GMT]]>Thanks both!

I'll look into adding the alg parameter and circle back.

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2405https://forum.pierobosio.it/post/https://activitypub.space/post/2405Sat, 29 Aug 2026 13:12:53 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 13:01:15 GMT]]>@mradcliffe @julian @Edent Agreed - my implementation adds the alg parameter.

But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.

https://portswigger.net/web-security/jwt/algorithm-confusion

]]>https://forum.pierobosio.it/post/https://mitra.social/objects/01a04d9c-2d5a-7bb0-8906-8122f4cde852https://forum.pierobosio.it/post/https://mitra.social/objects/01a04d9c-2d5a-7bb0-8906-8122f4cde852Sat, 29 Aug 2026 13:01:15 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 12:45:42 GMT]]>@mradcliffe @julian

If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.

]]>https://forum.pierobosio.it/post/https://mastodon.social/users/Edent/statuses/117178862326294615https://forum.pierobosio.it/post/https://mastodon.social/users/Edent/statuses/117178862326294615Sat, 29 Aug 2026 12:45:42 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 12:20:10 GMT]]>

@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include alg parameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assume rsa-v1_5-sha256 if it’s missing. I know that’s not great, but maybe we should all just agree to include alg?

I guess @Edent feels the same way.

]]>https://forum.pierobosio.it/post/https://nokoto.org/user/3/posts/1135https://forum.pierobosio.it/post/https://nokoto.org/user/3/posts/1135Sat, 29 Aug 2026 12:20:10 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 11:36:41 GMT]]>@julian

It works now, this time the response was quick (200 OK)

]]>https://forum.pierobosio.it/post/https://mitra.social/objects/01a04d4e-bff6-7c31-a5a1-c3c1a88e420chttps://forum.pierobosio.it/post/https://mitra.social/objects/01a04d4e-bff6-7c31-a5a1-c3c1a88e420cSat, 29 Aug 2026 11:36:41 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 03:31:11 GMT]]>

@julian Thank you. Unfortunately, it's not open... Yet. I am working on trying to split out what makes nokoto.org unique.

I know that I get RFC9421 successes from Gush at least. :-)

]]>https://forum.pierobosio.it/post/https://nokoto.org/user/3/replies/402https://forum.pierobosio.it/post/https://nokoto.org/user/3/replies/402Sat, 29 Aug 2026 03:31:11 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 03:09:09 GMT]]>@mradcliffe@nokoto.org if your software is open, I (or rather, my local AI <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f633.png?v=f52195b43b7" title=":flushed:" />) can do a deep dive.

@silverpill@mitra.social my laptop says the timeout is due to Mitra's 10s timeout (this may be incorrect), and to try again <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f914.png?v=f52195b43b7" title=":thinking_face:" /> activitypub.space is slow, it's hit by many scrapers and a 10+s response is not out of the ordinary.

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2404https://forum.pierobosio.it/post/https://activitypub.space/post/2404Sat, 29 Aug 2026 03:09:09 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 02:20:25 GMT]]>

@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.

]]>https://forum.pierobosio.it/post/https://nokoto.org/user/3/replies/397https://forum.pierobosio.it/post/https://nokoto.org/user/3/replies/397Sat, 29 Aug 2026 02:20:25 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 02:17:12 GMT]]>@mradcliffe@nokoto.org I am sending 9421 first, then cavage when it fails.

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2403https://forum.pierobosio.it/post/https://activitypub.space/post/2403Sat, 29 Aug 2026 02:17:12 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 02:06:55 GMT]]>

Are you sending RFC 9421 first or cavage-12 draft first?

Also this is a test to confirm verification.

]]>https://forum.pierobosio.it/post/https://nokoto.org/user/3/posts/1134https://forum.pierobosio.it/post/https://nokoto.org/user/3/posts/1134Sat, 29 Aug 2026 02:06:55 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 01:55:37 GMT]]>Nevermind @silverpill@mitra.social, I updated activitypub.space again. Can you let me know if my Announces are still throwing that error?

Let me know if you are able to look into the timeout issue.

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2402https://forum.pierobosio.it/post/https://activitypub.space/post/2402Sat, 29 Aug 2026 01:55:37 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Sat, 29 Aug 2026 01:09:33 GMT]]>> My server logs this error:
>
> invalid HTTP signature: invalid 'signature' dictionary

Is that an error output by your server itself, or a reflection from mine?

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2401https://forum.pierobosio.it/post/https://activitypub.space/post/2401Sat, 29 Aug 2026 01:09:33 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Fri, 28 Aug 2026 23:28:33 GMT]]>We do support activities, we just don't persist them. You can send Create(Note) just like everybody else, etc.

]]>https://forum.pierobosio.it/post/https://activitypub.space/post/2400https://forum.pierobosio.it/post/https://activitypub.space/post/2400Fri, 28 Aug 2026 23:28:33 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Fri, 28 Aug 2026 23:10:25 GMT]]>https://forum.pierobosio.it/post/https://rumbly.net/item/61e4170c-a8eb-4e34-9231-99117910d557https://forum.pierobosio.it/post/https://rumbly.net/item/61e4170c-a8eb-4e34-9231-99117910d557Fri, 28 Aug 2026 23:10:25 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Fri, 28 Aug 2026 22:37:37 GMT]]>
I apologize that my technical understanding is very limited, but I'm happy to try some experiments if you want.]]>https://forum.pierobosio.it/post/https://forum.statler.ws/item/d88ab1fe-0d0c-4086-9833-c00b11e78ea7https://forum.pierobosio.it/post/https://forum.statler.ws/item/d88ab1fe-0d0c-4086-9833-c00b11e78ea7Fri, 28 Aug 2026 22:37:37 GMT<![CDATA[Reply to RFC 9421 Testing endpoints? on Fri, 28 Aug 2026 21:35:53 GMT]]>I've sent an RFC-9421 signed POST request to https://activitypub.space/uid/1/inbox, it timed out. But that might be a problem on my end

I also saw an Announce activity coming from you. My server logs this error:

invalid HTTP signature: invalid 'signature' dictionary

]]>https://forum.pierobosio.it/post/https://mitra.social/objects/01a04a4c-f95e-7822-85ab-c4b82427e42chttps://forum.pierobosio.it/post/https://mitra.social/objects/01a04a4c-f95e-7822-85ab-c4b82427e42cFri, 28 Aug 2026 21:35:53 GMT