From 9ad3767987dae7e51d647768b655e93b82881343 Mon Sep 17 00:00:00 2001 From: silverpill Date: Sat, 1 Aug 2026 22:53:38 +0200 Subject: [PATCH] FEP-fe34: Anonymous objects inherit origin and owner (#897) - Anonymous objects inherit origin and owner. - Authentication of embedded objects in C2S context is required. Reviewed-on: https://codeberg.org/fediverse/fep/pulls/897 --- fep/fe34/fep-fe34.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fep/fe34/fep-fe34.md b/fep/fe34/fep-fe34.md index 5ad4abc..5f2655b 100644 --- a/fep/fe34/fep-fe34.md +++ b/fep/fe34/fep-fe34.md @@ -110,7 +110,7 @@ An embedded object can be trusted if the following conditions are met: Consumers MUST NOT trust embedded objects that do not satisfy these conditions. -In order to mitigate impersonation risks resulting from consumers not verifying ownership during the authentication, originating servers MUST enforce actor isolation by recursively verifying those objects when a client submits an activity. If an embedded object is owned by a different local actor, the server must either authenticate the object or reject the activity. +In order to mitigate impersonation risks resulting from consumers not verifying ownership during the authentication, originating servers MUST enforce actor isolation by recursively verifying embedded objects when a client submits an activity. If an embedded object is owned by a different local actor, the server must either authenticate the object or reject the activity. Embedded non-anonymous objects SHOULD NOT be partial representations. A server that relies on embedding for authentication might save a partial representation of an object to the cache, replacing the full object.