<![CDATA[**Can WebFinger resolve `subject` to a different domain?**]]>Can WebFinger resolve subject to a different domain?

My immediate assumption is yes, it can, because someone may use a specific domain merely as a gateway, and point to a different domain for resolution.

e.g. https://activitypub.directory/.well-known/webfinger?resource=acct:julian@activitypub.space (note the different TLD)

Resolving to:

{"subject":"acct:julian@activitypub.space","aliases":["https://activitypub.space/uid/1","https://activitypub.space/user/julian"],"links": ...

However, this is a potential security issue because said directory could then poison the resulting data, especially if cached by a user of that webfinger directory.

Am I wrong about that? In the meantime I've updated NodeBB's code to strictly enforce webfinger lookups so if a response subject has a different hostname, then the webfinger query result is considered invalid.

]]>https://bb.devnull.land/topic/04ff5e5c-03cf-4389-b2d4-df21e8431b98/can-webfinger-resolve-subject-to-a-different-domainRSS for NodeThu, 06 Aug 2026 14:44:26 GMTTue, 28 Jul 2026 15:39:52 GMT60<![CDATA[Reply to **Can WebFinger resolve `subject` to a different domain?** on Wed, 29 Jul 2026 10:44:35 GMT]]>@julian@activitypub.space @julian@fietkau.social thanks, most of the computing I do is numerical so as much as I try to keep up with how fedi works it's just not part of my day to day thought process and it's very educational to see threads like this one!

]]>https://bb.devnull.land/post/https://bayes.club/users/wronglang/statuses/117002854448753129https://bb.devnull.land/post/https://bayes.club/users/wronglang/statuses/117002854448753129Wed, 29 Jul 2026 10:44:35 GMT<![CDATA[Reply to **Can WebFinger resolve `subject` to a different domain?** on Wed, 29 Jul 2026 07:42:32 GMT]]>@julian If you want to be fully accurate, you can consider my "WebFinger ID" to not be trwnh@mastodon.social or acct:trwnh@mastodon.social but rather https://mastodon.social/.well-known/webfinger?resource=acct:trwnh@mastodon.social (which is linked to https://mastodon.social/users/trwnh via rel=self)

]]>https://bb.devnull.land/post/https://mastodon.social/users/trwnh/statuses/117002138551564927https://bb.devnull.land/post/https://mastodon.social/users/trwnh/statuses/117002138551564927Wed, 29 Jul 2026 07:42:32 GMT<![CDATA[Reply to **Can WebFinger resolve `subject` to a different domain?** on Wed, 29 Jul 2026 07:38:38 GMT]]>@julian You're not wrong -- it's just generally not considered "authoritative".

Compare to DNS via the authoritative nameserver, versus DNS via a public resolver. dns:trwnh.com is different than dns://8.8.8.8/trwnh.com in that the latter is explicitly resolved via Google, or dns://1.1.1.1/trwnh.com to resolve via Cloudflare.

]]>https://bb.devnull.land/post/https://mastodon.social/users/trwnh/statuses/117002123249736366https://bb.devnull.land/post/https://mastodon.social/users/trwnh/statuses/117002123249736366Wed, 29 Jul 2026 07:38:38 GMT<![CDATA[Reply to **Can WebFinger resolve `subject` to a different domain?** on Tue, 28 Jul 2026 21:43:14 GMT]]>@julian@activitypub.space Yo @by_caballero if I recall correctly this was a passion topic of yours, check out this fun thread!

]]>https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116999782061447996https://bb.devnull.land/post/https://fietkau.social/users/julian/statuses/116999782061447996Tue, 28 Jul 2026 21:43:14 GMT