Changeset d0cab9d in Klonkt

Timestamp:

06/24/2026 03:59:47 PM (3 months ago)

Author:

Robin Genis <roboburr@…>

Branches:

main

Children:

f5c3870

Parents:

00f669b

Message:

feat(security): enforce HTTP signatures on the inbox

Data-affecting activities (Create/Like/Announce/Follow/Delete/Undo/Accept/Reject)
must now carry a valid HTTP signature whose signer matches the claimed actor —
else 401. Stops forged replies/likes/follows/timeline posts. Discovery (GET) open.

Co-Authored-By: Claude <noreply@…>

File:

• src/services/ActivityPubService.js (modified) (1 diff)

src/services/ActivityPubService.js

@@ -358 +358 @@
   const type = act.type;
   const base = (process.env.PUBLIC_BASE_URL || `${req.protocol}://${req.get('host')}`).replace(/\/+$/, '');
-  const verified = await verifyRequest(req).catch(() => null); // best-effort; not gating (MVP)
+  const verified = await verifyRequest(req).catch(() => null);
+
+  // ENFORCE HTTP signatures: a data-affecting activity must be signed by the very
+  // actor it claims to be. No valid signature, or signer ≠ actor → reject (no
+  // forged replies/likes/follows/timeline posts). GET/discovery stays open.
+  const claimedActor = typeof act.actor === 'string' ? act.actor : (act.actor && act.actor.id);
+  const GATED = ['Create', 'Like', 'Announce', 'Follow', 'Delete', 'Undo', 'Accept', 'Reject'];
+  if (GATED.includes(type)) {
+    if (!verified || !claimedActor || verified.id !== claimedActor) {
+      console.warn('[AP] inbox REJECTED (signature)', type, claimedActor || '?', verified ? '(signer mismatch)' : '(unsigned/invalid)');
+      return 401;
+    }
+  }
 
   if (type === 'Follow') {