Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Framasoft
PeerTube
PeerTube
Commits
e08ec7a7
Verified
Commit
e08ec7a7
authored
May 06, 2022
by
Chocobozzz
Browse files
Handle HTTP signature draft 11
parent
822f50fa
Changes
3
Hide whitespace changes
Inline
Side-by-side
server/helpers/peertube-crypto.ts
View file @
e08ec7a7
...
...
@@ -51,11 +51,18 @@ function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): bool
}
function
parseHTTPSignature
(
req
:
Request
,
clockSkew
?:
number
)
{
const
h
eaders
=
req
.
method
===
'
POST
'
?
HTTP_SIGNATURE
.
REQUIRED_HEADERS
.
POST
:
HTTP_SIGNATURE
.
REQUIRED_HEADERS
.
ALL
const
requiredH
eaders
=
req
.
method
===
'
POST
'
?
[
'
(request-target)
'
,
'
host
'
,
'
digest
'
]
:
[
'
(request-target)
'
,
'
host
'
]
return
httpSignature
.
parse
(
req
,
{
clockSkew
,
headers
})
const
parsed
=
httpSignature
.
parse
(
req
,
{
clockSkew
,
headers
:
requiredHeaders
})
const
parsedHeaders
=
parsed
.
params
.
headers
if
(
!
parsedHeaders
.
includes
(
'
date
'
)
&&
!
parsedHeaders
.
includes
(
'
(created)
'
))
{
throw
new
Error
(
`date or (created) must be included in signature`
)
}
return
parsed
}
// JSONLD
...
...
server/initializers/constants.ts
View file @
e08ec7a7
...
...
@@ -589,11 +589,7 @@ const ACTIVITY_PUB_ACTOR_TYPES: { [ id: string ]: ActivityPubActorType } = {
const
HTTP_SIGNATURE
=
{
HEADER_NAME
:
'
signature
'
,
ALGORITHM
:
'
rsa-sha256
'
,
HEADERS_TO_SIGN
:
[
'
(request-target)
'
,
'
host
'
,
'
date
'
,
'
digest
'
],
REQUIRED_HEADERS
:
{
ALL
:
[
'
(request-target)
'
,
'
host
'
,
'
date
'
],
POST
:
[
'
(request-target)
'
,
'
host
'
,
'
date
'
,
'
digest
'
]
},
HEADERS_TO_SIGN
:
[
'
(request-target)
'
,
'
(created)
'
,
'
host
'
,
'
date
'
,
'
digest
'
],
CLOCK_SKEW_SECONDS
:
1800
}
...
...
server/tests/api/activitypub/security.ts
View file @
e08ec7a7
...
...
@@ -147,6 +147,17 @@ describe('Test ActivityPub security', function () {
}
})
it
(
'
Should succeed with a valid HTTP signature draft 11 (without date but with (created))
'
,
async
function
()
{
const
body
=
activityPubContextify
(
getAnnounceWithoutContext
(
servers
[
1
]),
'
Announce
'
)
const
headers
=
buildGlobalHeaders
(
body
)
const
signatureOptions
=
baseHttpSignature
()
signatureOptions
.
headers
=
[
'
(request-target)
'
,
'
(created)
'
,
'
host
'
,
'
digest
'
]
const
{
statusCode
}
=
await
makePOSTAPRequest
(
url
,
body
,
signatureOptions
,
headers
)
expect
(
statusCode
).
to
.
equal
(
HttpStatusCode
.
NO_CONTENT_204
)
})
it
(
'
Should succeed with a valid HTTP signature
'
,
async
function
()
{
const
body
=
activityPubContextify
(
getAnnounceWithoutContext
(
servers
[
1
]),
'
Announce
'
)
const
headers
=
buildGlobalHeaders
(
body
)
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment