Changeset 9910ba1 in Klonkt for src/middleware/render.js

Timestamp:

06/28/2026 01:34:06 PM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

73abbfd

Parents:

cca2e89

Message:

fix(fedi): verify HTTP signatures behind a Host-rewriting proxy

verifyRequest reconstructed the signing string's host line from the raw Host header, which a
reverse proxy that doesn't preserve Host (Apache .htaccess [P] -> backend sees localhost:3000)
makes wrong -> every signed Follow/Like/etc. from another server was rejected as unsigned/invalid
on a proxied instance. Now it tries each candidate host (PUBLIC_BASE_URL host, X-Forwarded-Host,
raw Host) and accepts if the signature verifies against any (an attacker can't forge a match).
Also normalises a leading in the request-target.

(No files)