[bug] Some redirects 404 for AP, only work for browser users #835

New issue

Open

opened 2024-09-24 18:37:17 +00:00 by mirabilos · 2 comments

mirabilos commented

2024-09-24 18:37:17 +00:00

Your setup

No response

Extra details

No response

Version

"2.7.2 (compatible; Akkoma 3.13.2)"

PostgreSQL version

No response

What were you trying to do?

Found by https://github.com/superseriousbusiness/gotosocial/issues/2643#issuecomment-2370906204 :

$ curl --http1.1 -D - -H 'accept: application/ld+json; profile="https://www.w3.org/ns/activitystreams"' https://infosec.place/users/AlXRUAEjZWsAzH4Zm4; echo                                               
HTTP/1.1 404 Not Found
Server: nginx/1.26.2
Date: Tue, 24 Sep 2024 18:36:24 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 11
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key
cache-control: max-age=0, private, must-revalidate
content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-SaKLRXO_tUN_VPo';font-src 'self';script-src 'self' 'nonce-SaKLRXO_tUN_VPo' ;connect-src 'self' https://infosec.place wss://infosec.place;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self';
permissions-policy: interest-cohort=()
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: DENY
x-permitted-cross-domain-policies: none
x-request-id: F_hB9pS_crsvLf4AOK4S
x-xss-protection: 0

"Not found"
$ curl --http1.1 -D - -H 'accept: application/activity+json' https://infosec.place/users/AlXRUAEjZWsAzH4Zm4; echo                                                                                          
HTTP/1.1 404 Not Found
Server: nginx/1.26.2
Date: Tue, 24 Sep 2024 18:36:25 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 11
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key
cache-control: max-age=0, private, must-revalidate
content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-coSHJtwvzoL6kWJ';font-src 'self';script-src 'self' 'nonce-coSHJtwvzoL6kWJ' ;connect-src 'self' https://infosec.place wss://infosec.place;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self';
permissions-policy: interest-cohort=()
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: DENY
x-permitted-cross-domain-policies: none
x-request-id: F_hB9ulzTKWg0TAAOK8S
x-xss-protection: 0

"Not found"
$ curl --http1.1 -D - -A 'Mozilla/5.0 (compatible; Firefox or something)' https://infosec.place/users/AlXRUAEjZWsAzH4Zm4; echo                                                                             
HTTP/1.1 302 Found
Server: nginx/1.26.2
Date: Tue, 24 Sep 2024 18:36:26 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 102
Connection: keep-alive
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key
cache-control: max-age=0, private, must-revalidate
content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-E_w2HubmmV7PE6Y';font-src 'self';script-src 'self' 'nonce-E_w2HubmmV7PE6Y' ;connect-src 'self' https://infosec.place wss://infosec.place;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self';
location: https://bird.makeup/users/evilsocket
permissions-policy: interest-cohort=()
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: DENY
x-permitted-cross-domain-policies: none
x-request-id: F_hB9yUAADe3YJ0AOLAS
x-xss-protection: 0

<html><body>You are being <a href="https://bird.makeup/users/evilsocket">redirected</a>.</body></html>
$ _

You really have to make the redirects work for AP requests as well, otherwise it can’t work when a user searches for a URL an Akkoma user sent them on their own instance.

What did you expect to happen?

No response

What actually happened?

No response

Logs

No response

Severity

No response

Have you searched for this issue?

I have double-checked and have not found this issue mentioned anywhere.

### Your setup _No response_ ### Extra details _No response_ ### Version "2.7.2 (compatible; Akkoma 3.13.2)" ### PostgreSQL version _No response_ ### What were you trying to do? Found by https://github.com/superseriousbusiness/gotosocial/issues/2643#issuecomment-2370906204 : ``` $ curl --http1.1 -D - -H 'accept: application/ld+json; profile="https://www.w3.org/ns/activitystreams"' https://infosec.place/users/AlXRUAEjZWsAzH4Zm4; echo HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Tue, 24 Sep 2024 18:36:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: keep-alive access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key cache-control: max-age=0, private, must-revalidate content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-SaKLRXO_tUN_VPo';font-src 'self';script-src 'self' 'nonce-SaKLRXO_tUN_VPo' ;connect-src 'self' https://infosec.place wss://infosec.place;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self'; permissions-policy: interest-cohort=() referrer-policy: same-origin x-content-type-options: nosniff x-frame-options: DENY x-permitted-cross-domain-policies: none x-request-id: F_hB9pS_crsvLf4AOK4S x-xss-protection: 0 "Not found" $ curl --http1.1 -D - -H 'accept: application/activity+json' https://infosec.place/users/AlXRUAEjZWsAzH4Zm4; echo HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Tue, 24 Sep 2024 18:36:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: keep-alive access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key cache-control: max-age=0, private, must-revalidate content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-coSHJtwvzoL6kWJ';font-src 'self';script-src 'self' 'nonce-coSHJtwvzoL6kWJ' ;connect-src 'self' https://infosec.place wss://infosec.place;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self'; permissions-policy: interest-cohort=() referrer-policy: same-origin x-content-type-options: nosniff x-frame-options: DENY x-permitted-cross-domain-policies: none x-request-id: F_hB9ulzTKWg0TAAOK8S x-xss-protection: 0 "Not found" $ curl --http1.1 -D - -A 'Mozilla/5.0 (compatible; Firefox or something)' https://infosec.place/users/AlXRUAEjZWsAzH4Zm4; echo HTTP/1.1 302 Found Server: nginx/1.26.2 Date: Tue, 24 Sep 2024 18:36:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 102 Connection: keep-alive access-control-allow-credentials: true access-control-allow-origin: * access-control-expose-headers: Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key cache-control: max-age=0, private, must-revalidate content-security-policy: upgrade-insecure-requests;style-src 'self' 'nonce-E_w2HubmmV7PE6Y';font-src 'self';script-src 'self' 'nonce-E_w2HubmmV7PE6Y' ;connect-src 'self' https://infosec.place wss://infosec.place;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'none';frame-ancestors 'none';manifest-src 'self'; location: https://bird.makeup/users/evilsocket permissions-policy: interest-cohort=() referrer-policy: same-origin x-content-type-options: nosniff x-frame-options: DENY x-permitted-cross-domain-policies: none x-request-id: F_hB9yUAADe3YJ0AOLAS x-xss-protection: 0 <html><body>You are being <a href="https://bird.makeup/users/evilsocket">redirected</a>.</body></html> $ _ ``` You really have to make the redirects work for AP requests as well, otherwise it can’t work when a user searches for a URL an Akkoma user sent them on their own instance. ### What did you expect to happen? _No response_ ### What actually happened? _No response_ ### Logs _No response_ ### Severity _No response_ ### Have you searched for this issue? - [x] I have double-checked and have not found this issue mentioned anywhere.

mirabilos added the

bug

label 2024-09-24 18:37:17 +00:00

floatingghost commented

2024-09-24 23:37:14 +00:00

Owner

i disagree with your analysis

we are not the authority on remote users - requesting the AP data for https://infosec.place/users/AlXRUAEjZWsAzH4Zm4, which is actually https://bird.makeup/users/evilsocket should indeed return 404 - you've requested AP, we cannot return that AP authoritatively, the url is not found

i disagree with your analysis we are _not_ the authority on remote users - requesting the AP data for `https://infosec.place/users/AlXRUAEjZWsAzH4Zm4`, which is _actually_ `https://bird.makeup/users/evilsocket` should indeed return 404 - you've requested AP, we cannot return that AP authoritatively, the url is not found

mirabilos commented

2024-09-25 20:15:32 +00:00

Author

But when an Akkoma user copies the link to a third-instance user’s profile and sends that link to me, it DOES NOT WORK unless you add the redirection which you ALREADY HAVE for the browser.

Just make it so that the 302 is also returned for AP requests and things will become interoperable.

But when an Akkoma user copies the link to a third-instance user’s profile and sends that link to me, it DOES NOT WORK unless you add the redirection which you ALREADY HAVE for the browser. Just make it so that the 302 is also returned for AP requests and things will become interoperable.