diff options
| author | Laura Hausmann <laura@hausmann.dev> | 2024-10-24 04:40:33 +0200 |
|---|---|---|
| committer | Julia Johannesen <julia@insertdomain.name> | 2024-11-20 19:17:24 -0500 |
| commit | 9ab25ede28f4f04ac2ae48c947e7668a9a6012b2 (patch) | |
| tree | c522d13594f065b6db5792fae4df2e972816c511 | |
| parent | fix: primitive 6: reject anonymous objects that were fetched by their id (diff) | |
| download | sharkey-9ab25ede28f4f04ac2ae48c947e7668a9a6012b2.tar.gz sharkey-9ab25ede28f4f04ac2ae48c947e7668a9a6012b2.tar.bz2 sharkey-9ab25ede28f4f04ac2ae48c947e7668a9a6012b2.zip | |
fix: primitives 9, 10 & 11: http signature validation doesn't enforce required headers or specify auth header name
| -rw-r--r-- | packages/backend/src/server/ActivityPubServerService.ts | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/packages/backend/src/server/ActivityPubServerService.ts b/packages/backend/src/server/ActivityPubServerService.ts index 52592c47c6..f955329fd1 100644 --- a/packages/backend/src/server/ActivityPubServerService.ts +++ b/packages/backend/src/server/ActivityPubServerService.ts @@ -152,7 +152,7 @@ export class ActivityPubServerService { let signature; try { - signature = httpSignature.parseRequest(request.raw, { 'headers': [] }); + signature = httpSignature.parseRequest(request.raw, { 'headers': ['(request-target)', 'host', 'date'], authorizationHeaderName: 'signature' }); } catch (e) { // not signed, or malformed signature: refuse this.authlogger.warn(`${request.id} ${request.url} not signed, or malformed signature: refuse`); @@ -229,7 +229,7 @@ export class ActivityPubServerService { let signature; try { - signature = httpSignature.parseRequest(request.raw, { 'headers': [] }); + signature = httpSignature.parseRequest(request.raw, { 'headers': ['(request-target)', 'digest', 'host', 'date'], authorizationHeaderName: 'signature' }); } catch (e) { reply.code(401); return; |