Renew HTTP signatures when following redirects #973

Merged
Oneric merged 13 commits from Oneric/akkoma:httpsig_redirect_resign into develop 2025-10-04 16:25:50 +00:00

13 commits

Author SHA1 Message Date
Oneric
b9f79f333f changelog: document changes wrt to http option config keys
All checks were successful
ci/woodpecker/pr/test/1 Pipeline was successful
ci/woodpecker/pr/test/2 Pipeline was successful
2025-09-07 00:00:00 +00:00
Oneric
cb19d3285a Drop superfluous RequestBuilder
It’s only used in one place and there not even all of
its functionality is needed. It’s not only simpler and shorter,
but easier to understand if Tesla’s keyword list is just inlined.

The only useful bit which is now migrated to Pleroma.HTTP is
addition of the user-agent header (except, sometimes, in tests)
2025-09-07 00:00:00 +00:00
Oneric
c607387b4a http: do not mix and duplicate Tesla opts into adapter opts 2025-09-07 00:00:00 +00:00
Oneric
271d7d14d4 media_proxy: use :head atom instead of binary
It automatically uses correct capitalisation and is the preferred form.
2025-09-07 00:00:00 +00:00
Oneric
7f9e898781 reverse_proxy: delete unused dynamic client
Since 364b6969eb the reverse proxy
is fixed to use the default HTTP module and all these modules
have been unused since
2025-09-07 00:00:00 +00:00
Oneric
882d8e0320 http/tzdata: ignore unsupported opts
Tzdata assumes Hackney opt names and only uses it to
enable following redirects which we already do anyway.
2025-09-07 00:00:00 +00:00
Oneric
a95b0a5d61 http/webpush: ignore opts due to incompatible format
The web_push_encryption lib assumes HTTPoison semantics
which is why we also need to convert the header format.
Inspecting the libraries source shows that Tesla won’t
understand the options anyway and its only used to enable TLS/SSL.
2025-09-07 00:00:00 +00:00
Oneric
5d59cb7ac3 rel_me: drop unsupported http option
Enforcing a hard response body limit is currently not possible with
Finch. Presumably a leftover from when multiple backends were supported.
2025-09-07 00:00:00 +00:00
Oneric
d34f6ebcdd rich_media/helpers: drop unsupported http opts
When this was ported from Pleroma in
5da9cbd8a5
we did not take into acount that Akkoma’s and Pleroma’s
HTTP backend take different options.
There’s no need for the :pool option
and enforcing a body limit on download
is currently not possible with Finch
2025-09-07 00:00:00 +00:00
Oneric
6d54bd95bc changelog: add entry for re-sign on redirect 2025-09-07 00:00:00 +00:00
Oneric
2b4b68eba7 Ensure private keys are not logged
Ideally we’d use a single common HTTP request error format handling
for _all_ HTTP requests (including non-ActivityPub requests, e.g. NodeInfo).
But for the purpose of this commit this would create too much noise
and it is significant effort to go through all error pattern matches etc
too ensure it is still all correct or update as needed.
2025-09-07 00:00:00 +00:00
Oneric
ff46e448c8 refactor: move creation of date strings for signatures into plug
The Signature module now handles interaction with the HTTPSignature library
and the plug everything related to HTTP itself. It now also no longer needs to be public.
2025-09-06 00:00:00 +00:00
Oneric
4c4982d611 Re-sign requests when following redirects
To achieve this signatures are now generated by a custom
Tesla Middleware placed after the FollowRedirects Middleware.
Any requests which should be signed needs
to pass the signing key via opts.

This also unifies the associated header logic between fetching and
publishing, notably resolving a divergence wrt the "host" header.
Relevant spec demands the host header shall include a port
identification if not using the protocols standard port.

Fixes: #731
2025-09-06 00:00:00 +00:00