Sorry, but requiring requests to public activitypub objects to be signed is completely whack, merveilles

submitted by

https://6-28.mastodon.xyz/media_attachments/files/116/284/181/877/450/833/original/af8bc0e022bbec1b.png

xh --follow "https://mastodon.xyz/@wim_v12e@merveilles.town/110180070993695741" Accept:application/activity+json HTTP/2.0 401 Unauthorized cache-control: private, no-store content-security-policy: base-uri 'none'; default-src 'none'; frame-ancestors 'none'; font-src 'self' https://merveilles.town; img-src 'self' https: data: blob: https://merveilles.town; style-src 'self' https://merveilles.town 'nonce-ci8BJ2XVV+iqIEWK976Ifg=='; media-src 'self' https: data: https://merveilles.town; frame-src 'self' https:; manifest-src 'self' https://merveilles.town; form-action 'self'; child-src 'self' blob: https://merveilles.town; worker-src 'self' blob: https://merveilles.town; connect-src 'self' data: blob: https://merveilles.town https://assets.merveilles.town wss://merveilles.town; script-src 'self' https://merveilles.town 'wasm-unsafe-eval' content-type: application/json; charset=utf-8 date: Tue, 24 Mar 2026 12:34:57 GMT referrer-policy: same-origin server: Mastodon strict-transport-security: max-age=63072000; includeSubDomains vary: Accept, Accept-Language, Cookie, Signature x-content-type-options: nosniff x-frame-options: DENY x-request-id: 62037fec-a978-4640-b772-f61cca1b432a x-runtime: 0.009568 x-xss-protection: 0 { "error": "Request not signed" }

Sorry, but requiring requests to public activitypub objects to be signed is completely whack, merveilles.town

#activitypub #mastodon

11
1

Log in to comment

Hot Top New Old

@Profpatsch interesting command line! What is that?

 reply
1
OP

@evan xh, a rust rewrite of httpie, both are a nicer UX alternative to curl for http-only use-case

 reply
1

@Profpatsch ohhhh. I thought it was AP-specific, probably because of the `--follow` flag. Thank you!

 reply
1
OP

@evan haha, no, but AP is such a plain protocol that you “usually” can use plain tools … unless people require weird signatures on GET requests. Then you need a full-on domain and an AP server just to fetch a json file …

 reply
1
OP

@evan The “funny” thing here is that avoiding the restriction is absolutely trivial, e.g. I can spin up a new (sub)domain or just `tailscale funnel` myself around the blocklists.

 reply
1

@profpatsch@mastodon.xyz right. Yeah it is definitely annoying from an AP dev perspective, I’ve tried debugging requests tons of times only to find out… oops, my requests are coming from localhost, so the signature can’t be verified 😅 :x:

There is a minor legitimate use case for requiring signatures on GET though, and that’s for retrieving user specific objects (like non-public notes and such)

@evan@cosocial.ca

 reply
3

@julian @Profpatsch oh, yeah, definitely. It's really our only way to authenticate requests right now.

 reply
1
Continue thread
edited

@profpatsch@mastodon.xyz isn’t this “authorized fetch”, a Mastodon safety feature?

(The efficacy of the safety feature is debated, but it’s a safety feature nonetheless.)

 reply
1

@julian @general @Profpatsch Yes, it's a safety feature whose purpose can be easily worked around. It's utterly pointless and only serves as annoyance for ActivityPub developers that need to get the Activities and Objects in a raw unmodified form with something simple like curl.

https://evilmaid.net/blog/trusting-trust-fediverse/index.html#fetching

 reply
2

@julian @general @Profpatsch its used when a instance doesnt want a blocked instance to see their posts. I dont get the point of it tbh

 reply
2
Insert image