Authorized Fetch #15

New issue

Open

opened 2025-01-10 12:07:19 +00:00 by ashten · 1 comment

ashten commented

2025-01-10 12:07:19 +00:00

Owner

Summary

Confirm that Auth Fetch exists, and if it doesnt, implement it

Purpose

Do you want to implement this feature yourself?

Yes, I will implement this by myself and send a pull request

### Summary Confirm that Auth Fetch exists, and if it doesnt, implement it ### Purpose . ### Do you want to implement this feature yourself? - [ ] Yes, I will implement this by myself and send a pull request

sugar commented

2025-01-11 00:26:19 +00:00

Owner

There doesn't seem to be an authorized fetch requirement implemented.

In general ActivityPubServerService.inbox and InboxProcessorService.process should help with the implementation, those functions essentially contain a full HTTP signature verification implementation, which should be extracted into separate functions. (I would prefer avoiding code duplication when Misskey already has a fine implementation of all the necessary checks, albeit this may not be trivial with InboxProcessorService.process, as some errors are unrecoverable when processing inbox queue, and some aren't).

The reason why I would want to avoid duplication is mostly to make future merges easier, if we copy and paste an implementation then if there will be any security vulnerabilities with the current implementation, we won't know about them if Misskey fixes them.

Also, authorized fetch requirement should be bypassed for instance actor (as otherwise another Forkey instance won't be able to fetch key used to verify instance.actor's requests).

When authorized fetch is enabled, Cache-Control: private, max-age=0, must-revalidate must be sent to tell nginx cache to not cache responses (as the response depends on sent HTTP signature).

There doesn't seem to be an authorized fetch requirement implemented. In general `ActivityPubServerService.inbox` and `InboxProcessorService.process` should help with the implementation, those functions essentially contain a full HTTP signature verification implementation, which should be extracted into separate functions. (I would prefer avoiding code duplication when Misskey already has a fine implementation of all the necessary checks, albeit this may not be trivial with `InboxProcessorService.process`, as some errors are unrecoverable when processing inbox queue, and some aren't). The reason why I would want to avoid duplication is mostly to make future merges easier, if we copy and paste an implementation then if there will be any security vulnerabilities with the current implementation, we won't know about them if Misskey fixes them. Also, authorized fetch requirement should be bypassed for instance actor (as otherwise another Forkey instance won't be able to fetch key used to verify instance.actor's requests). When authorized fetch is enabled, `Cache-Control: private, max-age=0, must-revalidate` must be sent to tell nginx cache to not cache responses (as the response depends on sent HTTP signature).