RFC 9421 Testing endpoints?
-
Is there a service or implementation that can test RFC 9421 implementations? I'm running a branch of NodeBB here on
activitypub.spacethat sends and receives RFC 9421 HTTP Signatures and I'd like to test against someone <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f603.png?v=f52195b43b7" title=":smiley:" />@silverpill@mitra.social perhaps?
-
I've sent an RFC-9421 signed POST request to https://activitypub.space/uid/1/inbox, it timed out. But that might be a problem on my end
I also saw an Announce activity coming from you. My server logs this error:
invalid HTTP signature: invalid 'signature' dictionary -
Streams and Forte support RFC 9421, with fallback to an older signature method if it fails. (I'm commenting from a streams instance.)
I apologize that my technical understanding is very limited, but I'm happy to try some experiments if you want. -
Hehe they might have to think outside the box and run it themselves... Could be useful to see the log.:)
-
We do support activities, we just don't persist them. You can send Create(Note) just like everybody else, etc.
-
I've sent an RFC-9421 signed POST request to https://activitypub.space/uid/1/inbox, it timed out. But that might be a problem on my end
I also saw an Announce activity coming from you. My server logs this error:
invalid HTTP signature: invalid 'signature' dictionary
> My server logs this error:
>
> invalid HTTP signature: invalid 'signature' dictionaryIs that an error output by your server itself, or a reflection from mine?
-
Nevermind @silverpill@mitra.social, I updated
activitypub.spaceagain. Can you let me know if myAnnounces are still throwing that error?Let me know if you are able to look into the timeout issue.
-
Are you sending RFC 9421 first or cavage-12 draft first?
Also this is a test to confirm verification.
-
Are you sending RFC 9421 first or cavage-12 draft first?
Also this is a test to confirm verification.
@mradcliffe@nokoto.org I am sending 9421 first, then cavage when it fails.
-
@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.
-
@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.
@mradcliffe@nokoto.org if your software is open, I (or rather, my local AI <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f633.png?v=f52195b43b7" title=":flushed:" />) can do a deep dive.
@silverpill@mitra.social my laptop says the timeout is due to Mitra's 10s timeout (this may be incorrect), and to try again <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f914.png?v=f52195b43b7" title=":thinking_face:" />
activitypub.spaceis slow, it's hit by many scrapers and a 10+s response is not out of the ordinary. -
@julian Thank you. Unfortunately, it's not open... Yet. I am working on trying to split out what makes nokoto.org unique.
I know that I get RFC9421 successes from Gush at least. :-)
-
It works now, this time the response was quick (200 OK)
-
It works now, this time the response was quick (200 OK)
@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include
algparameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assumersa-v1_5-sha256if it’s missing. I know that’s not great, but maybe we should all just agree to includealg?I guess @Edent feels the same way.
-
@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.
If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends. -
@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include
algparameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assumersa-v1_5-sha256if it’s missing. I know that’s not great, but maybe we should all just agree to includealg?I guess @Edent feels the same way.
@mradcliffe @julian @Edent Agreed - my implementation adds the
algparameter.But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.
https://portswigger.net/web-security/jwt/algorithm-confusion
-
@mradcliffe @julian @Edent Agreed - my implementation adds the
algparameter.But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.
https://portswigger.net/web-security/jwt/algorithm-confusion
Thanks both!
I'll look into adding the
algparameter and circle back. -
If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.
@Edent just tried to DM it from Loops and it doesn't recognize the account
-
If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.
@edent@mastodon.social okay. Hello @example@example.viii.fi !
-
Is there a service or implementation that can test RFC 9421 implementations? I'm running a branch of NodeBB here on
activitypub.spacethat sends and receives RFC 9421 HTTP Signatures and I'd like to test against someone <img class="not-responsive emoji" src="https://activitypub.space/assets/plugins/nodebb-plugin-emoji/emoji/android/1f603.png?v=f52195b43b7" title=":smiley:" />@silverpill@mitra.social perhaps?
@julian Feel free to abuse @actor@didkey.000090000.xyz or @dimkr@didkey.000090000.xyz
Ciao! Sembra che tu sia interessato a questa conversazione, ma non hai ancora un account.
Stanco di dover scorrere gli stessi post a ogni visita? Quando registri un account, tornerai sempre esattamente dove eri rimasto e potrai scegliere di essere avvisato delle nuove risposte (tramite email o notifica push). Potrai anche salvare segnalibri e votare i post per mostrare il tuo apprezzamento agli altri membri della comunità.
Con il tuo contributo, questo post potrebbe essere ancora migliore 💗
Registrati Accedi