mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-05 19:55:46 +00:00
Code Packages Wiki Activity

FEP-ae97: Security considerations (#595)

Browse Source 
- Added "Security considerations" section.
- Require actor keys to have server's origin.

Reviewed-on: https://codeberg.org/fediverse/fep/pulls/595
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>
This commit is contained in:
silverpill
2025-05-12 11:23:06 +00:00
committed by silverpill
parent f44407c84c
commit fd0a6abe87
1 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/ae97/fep-ae97.md
+19 -3
View File
@@ -29,7 +29,7 @@ Before registering a portable actor on the server, the client MUST add the serve
To register the actor, the client sends an HTTP POST request to the gateway endpoint at `/.well-known/apgateway` path. The body of the request MUST be an actor object.
The server SHOULD limit registrations (for example, by requiring an invite code). If the server accepts registration request, it generates an RSA key and returns it in a response. The response MUST have the `201 Created` status code. The body of the response is a JSON object with an `assertionMethod` property. The value of this property is an array containing the RSA public key generated by the server in the [Multikey][CI-Multikey] format.
The server SHOULD limit registrations (for example, by requiring an invite code). If the server accepts the registration request, it generates an RSA key and returns it in a response. The response MUST have the `201 Created` status code. The body of the response is a JSON object with an `assertionMethod` property. The value of this property is an array containing the RSA public key generated by the server in the [Multikey][CI-Multikey] format.
Example:
@@ -46,11 +46,13 @@ Example:
The client MUST attach the RSA key to the actor object via `publicKey` property, and also add it to the `assertionMethod` array as described in [FEP-521a]. If the server's response contains other keys, they SHOULD be added to the `assertionMethod` array as well.
If the client uses [compatible identifiers][CompatibleIdentifiers], then key identifiers MUST be generated with the server's [origin][Origin].
After updating the actor object, the client MUST publish an `Update` activity for it.
## Sending activities
Client submits signed [FEP-ef61] activities to actor's outbox. Contrary to what ActivityPub specification prescribes in section [6. Client to Server Interactions](https://www.w3.org/TR/activitypub/#client-to-server-interactions), the server MUST NOT overwrite the ID of activity. Instead of assigning a new ID, the server MUST verify that provided ID has not been used before. If activity ID is in compatible format (HTTP(S) URI), the server MUST check that its [origin][Origin] is the same as the server's origin. If the server accepts activity, its response MUST have `202 Accepted` status code.
The client submits signed [FEP-ef61] activities to actor's outbox. Contrary to what ActivityPub specification prescribes in section [6. Client to Server Interactions](https://www.w3.org/TR/activitypub/#client-to-server-interactions), the server MUST NOT overwrite the ID of an activity. Instead of assigning a new ID, the server MUST verify that provided ID has not been used before. If the server accepts activity, its response MUST have `202 Accepted` status code.
If activity contains a wrapped object (as in `Create` and `Update` activities), it MUST be a portable object created according to [FEP-ef61]. The server MUST validate object IDs in the same way it validates activity IDs.
@@ -62,6 +64,15 @@ Client receives activities by polling the actor's inbox.
Requests to inbox endpoint MUST have an [HTTP signature][HttpSig] created using a key associated with actor's DID authority (the "authority" component of actor's ID).
## Security considerations
If the server accepts portable objects with [compatible identifiers][CompatibleIdentifiers], it MUST ensure that all objects served by the gateway are valid and that registered actors are sufficiently isolated from each other. Specifically, the server MUST verify that actors and activities generated by the client do not violate the assumptions of the [origin-based security model][FEP-fe34]:
- Objects MUST NOT represent any actions that actors are not authorized to perform.
- Objects MUST NOT represent public keys or verification methods. Such objects can be identifed using the algorithm from [FEP-2277].
Precautions need also be taken when objects with compatible IDs are delivered to inboxes or fetched from remote servers.
## Implementations
- [fep-ae97-client](https://codeberg.org/silverpill/fep-ae97-client) (client)
@@ -74,6 +85,8 @@ Requests to inbox endpoint MUST have an [HTTP signature][HttpSig] created using
- silverpill, [FEP-c390: Identity Proofs][FEP-c390], 2022
- silverpill, [FEP-ef61: Portable Objects][FEP-ef61], 2023
- silverpill, [FEP-521a: Representing actor's public keys][FEP-521a], 2023
- silverpill, [FEP-fe34: Origin-based security model][FEP-fe34], 2024
- silverpill, [FEP-2277: ActivityPub core types][FEP-2277], 2025
- Dave Longley, Manu Sporny, Markus Sabadello, Drummond Reed, Orie Steele, Christopher Allen, [Controlled Identifiers v1.0][ControlledIdentifiers], 2025
- Ryan Barrett, nightpool, [ActivityPub and HTTP Signatures][HttpSig], 2024
@@ -81,11 +94,14 @@ Requests to inbox endpoint MUST have an [HTTP signature][HttpSig] created using
[RFC-2119]: https://tools.ietf.org/html/rfc2119.html
[FEP-c390]: https://codeberg.org/fediverse/fep/src/branch/main/fep/c390/fep-c390.md
[FEP-ef61]: https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md
[CompatibleIdentifiers]: https://codeberg.org/fediverse/fep/src/branch/main/fep/ef61/fep-ef61.md#identifiers-1
[FEP-521a]: https://codeberg.org/fediverse/fep/src/branch/main/fep/521a/fep-521a.md
[FEP-fe34]: https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md
[Origin]: https://codeberg.org/fediverse/fep/src/branch/main/fep/fe34/fep-fe34.md#origin
[FEP-2277]: https://codeberg.org/fediverse/fep/src/branch/main/fep/2277/fep-2277.md
[ControlledIdentifiers]: https://www.w3.org/TR/cid/
[CI-Multikey]: https://www.w3.org/TR/cid/#Multikey
[HttpSig]: https://swicg.github.io/activitypub-http-signature/
[Origin]: https://developer.mozilla.org/en-US/docs/Glossary/Origin
## Copyright