AkkomaGang/akkoma

Fork 112

Tracking the State HTTP Signature Route Aliases across Implementations #1054

New issue

Open

opened 2026-01-23 20:46:32 +00:00 by Oneric · 0 comments

Oneric commented

2026-01-23 20:46:32 +00:00

Owner

With things having evolved since, this is kind of a successor to #731

There are two reasons why we curretnly allow route aliases when verifying signatures. First the query string confusion stemming from a historic long-standing Mastodon bug. Second a hardcoded extra set of aliases for frontend display URLs due to similar historic bugs Pleroma and Mastodon where they forg*t to resign when encountering redirects while fetching.

We likely won’t be able to completely get rid of the first one in the near future. However, we might if adoption improves eventually want to switch our prefernce order and reconsider how we sign our own outgoing requests.
But the second one is only relevant for manual fetches/searches when both the fetching instance is buggy wrt to redirects and the fetching user mistakenly copied the browser URL instead of using the "copy link" button (which in akko-fe now always prefers the canonical ID since AkkomaGang/akkoma-fe#459). Meaning once correctly resigning on redirects is sufficiently common we could drop this set of aliases (they incur extra cost since generating them requires a database lookup unlike the query-param aliases).

Handling of redirects per implementation

Correctly re-signs

Bridgy (see: snarfed/bridgy-fed@8bd4192553/activitypub.py (L914) )
Iceshrimp.NET (tested by initiating a display-url fetch with extra logging on Akkoma side)
GtS (since: https://codeberg.org/superseriousbusiness/gotosocial/pulls/2798 )
Akkoma (since #973)
Mastodon (since https://github.com/mastodon/mastodon/pull/33757)

Unknown

upub

Broken; doesn’t re-sign

*key ( https://activitypub.software/TransFem-org/Sharkey/-/issues/1250 )
snac (https://codeberg.org/grunfink/snac2/issues/533)
Pleroma (as of 2.10.0)

Handling of query parameters per implementation

(last updated in January 2026)

Prefers with query-params; allows both for incoming

Unconditionally uses query-params for outgoing

Iceshrimp.NET (see: Iceshrimp.Backend/Core/Federation/Cryptography/HttpSignature.cs )
upub (see: alemidev/upub@d57fbb7696; has config options to toggle prefernce, but never a retry mechanism; before this commit only accepted with query-params)

Has retry mechansim to use query-less if with-query-params fails for outgoing

Prefers without query-params; allows both for incoming

Unconditionally uses query-less for outgoing

Akkoma
Pleroma
Sharkey; likely now other keys too (historically they required with query-params for incoming while at the same time always generating without query params for outgoing; see: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/966 )

Has retry mechanism to use with-query if query-less fails for outgoing

Mastodon (see: https://github.com/mastodon/mastodon/issues/18638 and https://github.com/mastodon/mastodon/pull/28788)

Only accepts without query params

(none known)

Only accepts with query params

(none known)

Unknown

snac

With things having evolved since, this is kind of a successor to #731 There are two reasons why we curretnly allow route aliases when verifying signatures. First the query string confusion stemming from a historic long-standing Mastodon bug. Second a hardcoded extra set of aliases for frontend display URLs due to similar historic bugs Pleroma and Mastodon where they forg*t to resign when encountering redirects while fetching. We likely won’t be able to completely get rid of the first one in the near future. However, we might if adoption improves eventually want to switch our prefernce order and reconsider how we sign our own outgoing requests. But the second one is only relevant for manual fetches/searches when both the fetching instance is buggy wrt to redirects _and_ the fetching user mistakenly copied the browser URL instead of using the "copy link" button *(which in akko-fe now always prefers the canonical ID since https://akkoma.dev/AkkomaGang/akkoma-fe/pulls/459)*. Meaning once correctly resigning on redirects is sufficiently common we could drop this set of aliases (they incur extra cost since generating them requires a database lookup unlike the query-param aliases). ---- ## Handling of redirects per implementation ### Correctly re-signs - Bridgy (see: https://github.com/snarfed/bridgy-fed/blob/8bd41925535f3bfe5df9904f5433a11e3fe10e18/activitypub.py#L914 ) - Iceshrimp.NET *(tested by initiating a display-url fetch with extra logging on Akkoma side)* - GtS (since: https://codeberg.org/superseriousbusiness/gotosocial/pulls/2798 ) - Akkoma (since #973) - Mastodon (since https://github.com/mastodon/mastodon/pull/33757) ### Unknown - upub ### Broken; doesn’t re-sign - \*key ( https://activitypub.software/TransFem-org/Sharkey/-/issues/1250 ) - snac (https://codeberg.org/grunfink/snac2/issues/533) - Pleroma (as of 2.10.0) ---- ---- ## Handling of query parameters per implementation *(last updated in January 2026)* ### Prefers with query-params; allows both for incoming #### Unconditionally uses query-params for outgoing - Iceshrimp.NET (see: [`Iceshrimp.Backend/Core/Federation/Cryptography/HttpSignature.cs`](https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/src/commit/a601649600701defd7bcf4253c3964b9a58f300d/Iceshrimp.Backend/Core/Federation/Cryptography/HttpSignature.cs#L122) ) - upub (see: https://github.com/alemidev/upub/commit/d57fbb769638ecd911cc4b531834ad8719b473dc; has config options to toggle prefernce, but never a retry mechanism; before this commit only accepted with query-params) #### Has retry mechansim to use query-less if with-query-params fails for outgoing - GtS ### Prefers without query-params; allows both for incoming #### Unconditionally uses query-less for outgoing - Akkoma - Pleroma - Sharkey; likely now other keys too *(historically they required with query-params for incoming while at the same time always generating _without_ query params for outgoing; see: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/966 )* #### Has retry mechanism to use with-query if query-less fails for outgoing - Mastodon (see: https://github.com/mastodon/mastodon/issues/18638 and https://github.com/mastodon/mastodon/pull/28788) ### Only accepts without query params *(none known)* ### Only accepts with query params *(none known)* ### Unknown - snac

Oneric added the

not a bug

label

2026-01-23 20:47:12 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

AkkomaGang/akkoma#1054

No description provided.

Rows
Columns