**Can WebFinger resolve `subject` to a different domain?**
-
Can WebFinger resolve
subjectto a different domain?My immediate assumption is yes, it can, because someone may use a specific domain merely as a gateway, and point to a different domain for resolution.
e.g.
https://activitypub.directory/.well-known/webfinger?resource=acct:julian@activitypub.space(note the different TLD)Resolving to:
{"subject":"acct:julian@activitypub.space","aliases":["https://activitypub.space/uid/1","https://activitypub.space/user/julian"],"links": ...However, this is a potential security issue because said directory could then poison the resulting data, especially if cached by a user of that webfinger directory.
Am I wrong about that? In the meantime I've updated NodeBB's code to strictly enforce webfinger lookups so if a response subject has a different hostname, then the webfinger query result is considered invalid.
-
@julian@activitypub.space I haven't fully thought through the ramifications, but it would be slightly simpler (for situations other than mere static file hosting) to ask the WebFinger domain owner to set up an HTTP redirect for /.well-known/webfinger back to the ActivityPub server. The ActivityPub server could then do an ACME-like (as in Let's Encrypt) challenge to check that this redirect is in place, and if so, proceed to serve the correct WebFinger payload itself.
@julian@activitypub.space Yo @by_caballero if I recall correctly this was a passion topic of yours, check out this fun thread!
-
? [[global:guest]] crossposted this topic to General Discussion
-
@julian You're not wrong -- it's just generally not considered "authoritative".
Compare to DNS via the authoritative nameserver, versus DNS via a public resolver. dns:trwnh.com is different than dns://8.8.8.8/trwnh.com in that the latter is explicitly resolved via Google, or dns://1.1.1.1/trwnh.com to resolve via Cloudflare.
-
@julian You're not wrong -- it's just generally not considered "authoritative".
Compare to DNS via the authoritative nameserver, versus DNS via a public resolver. dns:trwnh.com is different than dns://8.8.8.8/trwnh.com in that the latter is explicitly resolved via Google, or dns://1.1.1.1/trwnh.com to resolve via Cloudflare.
@julian If you want to be fully accurate, you can consider my "WebFinger ID" to not be trwnh@mastodon.social or acct:trwnh@mastodon.social but rather https://mastodon.social/.well-known/webfinger?resource=acct:trwnh@mastodon.social (which is linked to https://mastodon.social/users/trwnh via rel=self)
-
@julian@activitypub.space @julian@fietkau.social thanks, most of the computing I do is numerical so as much as I try to keep up with how fedi works it's just not part of my day to day thought process and it's very educational to see threads like this one!
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login