luckyimnotanigger/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2025-05-31 11:52:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

activitypub: Sign the Host header too

Browse source 
Mastodon with `AUTHORIZED_FETCH` enabled requires the `Host` header to
be signed too, add it to the default for `setting.Federation.GetHeaders`
and `setting.Federation.PostHeaders`.

For this to work, we need to sign the request later: not immediately
after `NewRequest`, but just before sending them out with `client.Do`.
Doing so also lets us use `setting.Federation.GetHeaders` (we were using
`.PostHeaders` even for GET requests before).

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
This commit is contained in:
Gergely Nagy 2024-08-04 15:34:31 +02:00
parent c031881a20
commit cd17eb0fa7
No known key found for this signature in database
2 changed files with 30 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/setting/federation.go
View file

@ -25,8 +25,8 @@ var (
MaxSize: 4,
Algorithms: []string{"rsa-sha256", "rsa-sha512", "ed25519"},
DigestAlgorithm: "SHA-256",
GetHeaders: []string{"(request-target)", "Date"},
PostHeaders: []string{"(request-target)", "Date", "Digest"},
GetHeaders: []string{"(request-target)", "Date", "Host"},
PostHeaders: []string{"(request-target)", "Date", "Host", "Digest"},
}
)