diff options
| author | Ariadne Conill <ariadne@dereferenced.org> | 2019-08-14 19:00:48 +0000 |
|---|---|---|
| committer | Ariadne Conill <ariadne@dereferenced.org> | 2019-08-14 19:15:50 +0000 |
| commit | 974488a52e3dc4ef7628c2fb6caa2f110083953b (patch) | |
| tree | 1ffb1a6387b8b30eca72688d02810764cddeb9b9 | |
| parent | acc3c0ed58d2f0609553da48c409e7bbaa5354f9 (diff) | |
activitypub: publisher: add (request-target) to http signature when POSTing
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | lib/pleroma/web/activity_pub/publisher.ex | 5 |
2 files changed, 5 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 04ff4453e..cd0541eb3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [1.0.6] - 2019-08-14 ### Fixed - MRF: fix use of unserializable keyword lists in describe() implementations +- ActivityPub S2S: POST requests are now signed with `(request-target)` pseudo-header. ## [1.0.5] - 2019-08-13 ### Fixed diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex index 3d181f57c..4b037c139 100644 --- a/lib/pleroma/web/activity_pub/publisher.ex +++ b/lib/pleroma/web/activity_pub/publisher.ex @@ -44,7 +44,9 @@ defmodule Pleroma.Web.ActivityPub.Publisher do """ def publish_one(%{inbox: inbox, json: json, actor: %User{} = actor, id: id} = params) do Logger.info("Federating #{id} to #{inbox}") - host = URI.parse(inbox).host + uri = URI.parse(inbox) + host = uri.host + path = uri.path digest = "SHA-256=" <> (:crypto.hash(:sha256, json) |> Base.encode64()) @@ -54,6 +56,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do signature = Pleroma.Signature.sign(actor, %{ + "(request-target)": "post #{path}", host: host, "content-length": byte_size(json), digest: digest, |