mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-05 11:46:04 +00:00
Code Packages Wiki Activity

FEP-7502: Limiting visibility to authenticated actors

Browse Source
This commit is contained in:
a
2023-12-24 05:49:32 -06:00
committed by silverpill
parent db3abb1ae7
commit 8908b8ee8f
1 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/7502/fep-7502.md
+66
View File
@@ -0,0 +1,66 @@
---
slug: "7502"
authors: a <a@trwnh.com>
status: DRAFT
dateReceived: 2023-12-24
---
# FEP-7502: Limiting visibility to authenticated actors
## Summary
Some servers require authentication for all requests made via ActivityPub, even for GET requests on public objects addressed to `as:Public`. This violates the requirement that anything addressed to `as:Public` is made available without requiring authentication. This FEP proposes an alternative addressing that may be used in such scenarios, signaling that the object is not fully public but is otherwise available to any actor.
## Prior art
(This section is non-normative.)
ActivityPub issue [339] discusses the shortcomings of `as:Public` and proposed a new delivery/addressing target of `as:Authenticated`, but this proposal was never adopted. The distinction between the two is as follows:
Public
: Available to anyone without authentication
Authenticated
: Available to any actor after authentication
Issues raised with this approach include:
- the lack of semantic clarity around addressing pseudo-collections (including as:Public) as it relates to post-delivery use cases
- the ease of creating puppet actors making this ineffective for anti-abuse use cases
- the potential for tracking authenticated fetches that may occur
The concern with semantic clarity is unaddressed, as replacing as:Public with a different mechanism to signal fully public objects is out-of-scope for this FEP. However, this mechanism is still useful for addressing different concerns:
- signaling an intent to disallow unauthenticated access, instead of lying about the object being fully "public"
- a minimal level of tracking authentication being desirable in cases where blocks are to be enforced, by adding friction to fetching
In [WAC], there is a distinction made between an "agent" (`http://xmlns.com/foaf/0.1/Agent`) and an "authenticated agent" (`http://www.w3.org/ns/auth/acl#AuthenticatedAgent`). This FEP proposes an addressing target for the latter.
## Proposal
In addition to collections and objects, Activities may additionally be addressed to a special "authenticated" collection, with the identifier `http://www.w3.org/ns/auth/acl#AuthenticatedAgent`.
Activities addressed to this special URI shall be accessible to all actors, with authentication. Implementations MUST NOT deliver to the "authenticated" special collection; it is not capable of receiving actual activities.
An activity SHOULD NOT be addressed to both "public" and "authenticated". In such a case, addressing to "authenticated" has no effect while also addressed to "public".
### Overview
- ActivityPub Clients MAY author an activity that is addressed `to` or `cc` or includes in the `audience` the "authenticated agents" special identifier.
- ActivityPub Servers receiving such an activity addressed to "authenticated agents" MUST enforce some method of authenticating actors on fetch, if the activity is persisted. (No specific method is required by this FEP, but in most practical cases it is currently sufficient to use the HTTP Signatures Cavage draft and sign the GET request with a domain-wide internal fetch actor representing the service running on that domain.)
- ActivityPub Federated Servers that operate as an "instance" receiving such an activity addressed to "authenticated agents" MUST NOT serve representations of the received activity to any logged-out users.
### Implementations
Pixelfed intends to implement this FEP when "signed fetch" is enabled, such that the resulting data returned after a signed fetch does not include `as:Public`.
## References
- [ActivityPub] Christine Lemmer Webber, Jessica Tallon, [ActivityPub](https://www.w3.org/TR/activitypub/), 2018
- [339] kaniini, [as:Authenticated proposal](https://github.com/w3c/activitypub/issues/339), 2019
= [WAC] Sarven Capadisli, Tim Berners-Lee, Henry Story, [Web Access Control](https://solid.github.io/web-access-control-spec/), 2023
## Copyright
CC0 1.0 Universal (CC0 1.0) Public Domain Dedication
To the extent possible under law, the authors of this Fediverse Enhancement Proposal have waived all copyright and related or neighboring rights to this work.