mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-06 04:05:53 +00:00
Code Packages Wiki Activity

FEP-fe34: Anonymous objects inherit origin and owner (#897)

Browse Source 
- Anonymous objects inherit origin and owner.
- Authentication of embedded objects in C2S context is required.

Reviewed-on: https://codeberg.org/fediverse/fep/pulls/897
This commit is contained in:
silverpill
2026-08-01 22:53:38 +02:00
committed by silverpill
parent 3050a7b82e
commit 9ad3767987
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/fe34/fep-fe34.md
+1 -1
View File
@@ -110,7 +110,7 @@ An embedded object can be trusted if the following conditions are met:
Consumers MUST NOT trust embedded objects that do not satisfy these conditions.
In order to mitigate impersonation risks resulting from consumers not verifying ownership during the authentication, originating servers MUST enforce actor isolation by recursively verifying those objects when a client submits an activity. If an embedded object is owned by a different local actor, the server must either authenticate the object or reject the activity.
In order to mitigate impersonation risks resulting from consumers not verifying ownership during the authentication, originating servers MUST enforce actor isolation by recursively verifying embedded objects when a client submits an activity. If an embedded object is owned by a different local actor, the server must either authenticate the object or reject the activity.
Embedded non-anonymous objects SHOULD NOT be partial representations. A server that relies on embedding for authentication might save a partial representation of an object to the cache, replacing the full object.