Gods I don't like HTTP signatures. Why couldn't we use something sensible in the fediverse and not this outdated draft of something that is not a great fit for our problem domain anyways -.-
0 Boosts
0 Likes
@jenniferplusplus A lot of it is just that I'm very used to systems that perturb the headers in some way—it's very common in multitenant setups, for example—and that is rendered complex in a world where the _sender_ can tell you which headers you can perturb without rendering the entire thing invalid.
So basically it's not the end of the world and it does have advantages, but at the cost of eliminating one of the more flexible and common tools in the space.
@hrefna yeah, that does add a wrinkle. But it seems like yet another argument for moving http signature ~~auth~~ validation into the perimeter layer. Then it can perturb as much as it likes, including by attaching a simpler auth token for the backend to consume
@hrefna masto supports (most of) rfc 9421 now. I would just target that and ignore the old draft in new projects.
But I'm curious why you think it's not a fit for our domain? In my view, it enables self asserted authentication and it prevents forwarding of authenticated messages or reuse of authentication tokens. Both those properties are critical, imo.