`401 Unauthorized` when attempting to retrieve an object #929

New issue

Closed

opened 2025-05-15 19:44:35 +00:00 by silverpill · 1 comment

silverpill commented

2025-05-15 19:44:35 +00:00

Some Akkoma servers return 401 Unauthorized status in response to a GET request. What does it mean?

Other servers often return this status when request's HTTP signature is not valid. However, I suspect that Akkoma uses it to indicate a server-level block. Could you confirm? And if this is true, would you consider changing the status to 403 Forbidden, which is more common?

Some Akkoma servers return `401 Unauthorized` status in response to a GET request. What does it mean? Other servers often return this status when request's HTTP signature is not valid. However, I suspect that Akkoma uses it to indicate a server-level block. Could you confirm? And if this is true, would you consider changing the status to `403 Forbidden`, which is more common?

silverpill changed title from ~~401 Unauthorized when attemting to retrieve an object~~ to 401 Unauthorized when attempting to retrieve an object

2025-05-15 19:44:48 +00:00

Oneric commented

2025-05-15 20:07:50 +00:00

Owner

It doesn’t intentionally return 401 for specifically blocked domains, but anything which results in the signature not being verified ((e.g. not fetching the remote pubkey due to MRF blocks) when one is required eventually runs into 401.

Impossible to handle until #874 is merged; afterwards it should be quite simple to special case MRF rejects on the key id analogously to :gone handling

It doesn’t intentionally return `401` for specifically blocked domains, but anything which results in the signature not being verified (*(e.g. not fetching the remote pubkey due to MRF blocks)* when one is required eventually runs into `401`. Impossible to handle until #874 is merged; afterwards it should be quite simple to special case MRF rejects on the key id analogously to `:gone` handling

👍 1