2026-09-17 16:45 UTC
Dismissing HTTP Signature on presence of Object Integrity Proof
Additional points:
I know of no situation where an AP-compliant server POSTs another server without an HTTP Signature. Pretty sure any attempt to do so would just mean the activity is dropped.
So why does 8b32 allow for dropping the HTTP signature? My best guess is that the wording is vague and the intention is that an object integrity proof at top level means an HTTP signature can be discarded.
Cross-origin activity-object combos are common. FEP 1b12 is built upon this, as are standard Mastodon Announce/boosts. To give up HTTP signature checks because an embedded object contains a proof means the wrapping activity is spoofable.
So I think the local LLM took that line very literally.
Replies (1)
-
@silverpill@mitra.social 2026-09-17 18:30
@julian So why does 8b32 allow for dropping the HTTP signature? My best guess is that the wording is vague and the intention is that an object integrity proof at top level means an HTTP signature can be discarded. You're right, the sentence was poorly written. It was meant to apply to top-level proofs only. I'll update the FEP. I know of no situation where an AP-compliant server POSTs another server without an HTTP Signature. Pretty sure any attempt to do so would just mean the activity is dropped. Mitra would accept an activity with integrity proof if HTTP signature is not present.