Changeset c55fb34 in Klonkt for CHANGELOG.md

Timestamp:

07/01/2026 01:03:39 AM (2 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

cf314b4

Parents:

f0807cc

Message:

fix(federation): HTTP-sig replay window + mandatory digest (lqx); block boost-origin + exact-host purge (4lq)

lqx — verifyRequest now requires the Date header to be SIGNED and recent
(default +/-60min, env AP_SIG_MAX_SKEW_MIN), and requires a SIGNED Digest on
any request carrying a body. Without these a captured signed request could be
replayed indefinitely, or its body swapped (the body was uncovered by the
signature when Digest wasn't in the signed header set).

4lq — the Announce (boost) handler now drops a boost whose ORIGINAL author is
blocked (isBlockedAny(origUri)), closing a block bypass via someone else's
boost; and purgeBlocked matches a blocked domain by exact parsed host (same as
isBlockedAny) instead of a URL LIKE that missed bare-domain/:port actor URIs.

• src/services/ActivityPubService.js — verifyRequest (date window + mandatory digest), Announce block-origin guard, purgeBlocked exact-host

Co-Authored-By: Claude <noreply@…>

(No files)