Julien Deswaef
https://mastodon.social/@xuv
•
Jul 7
@aaronpk PS: I should mention that I started following you from the other instance. But still could not see your post before searching for it.
Julien Deswaef
https://mastodon.social/@xuv
•
Jul 7
@aaronpk yes. Exactly tried that. It does not work. Also, I can't seem to see the boost I did from a different instance looking at this account.
Julien Deswaef
https://mastodon.social/@xuv
•
Jul 7
@aaronpk for some reason, this post does not federate well with all Mastodon instances. I'm trying to boost it from another account elsewhere, but I can't seem to see it. Any clue?
Julien Deswaef
https://mastodon.social/@xuv
•
Jul 7
@aaronpk for some reason, this post does not federate well with all Mastodon instances. I'm trying to boost it from another account elsewhere, but I can't seem to see it. Any clue?
Eugen
https://mastodon.social/@Gargron
•
Jul 7
IndieAuth sounds interesting as a more generic way for federated applications to allow app registrations https://indieauth.spec.indieweb.org/
The question is how do we adapt this after our current, extremely similar but somewhat different system has been in production use for around 2 years #mastodev
Sven Knebel
https://www.svenknebel.de/
•
Jul 7
donpdonp
https://mastodon.xyz/@donpdonp
•
Jul 6
we've got the seeds of federated twitter, instagram, and youtube. it seems there's a gap in the federated reddit space. group/tag/topic organized links/text.
donpdonp
https://mastodon.xyz/@donpdonp
•
Jul 6
@aaronpk ah what i should have said is the feed includes sites that are implemented in ... p3k.io... etc.
donpdonp
https://mastodon.xyz/@donpdonp
•
Jul 6
my mastodon feed now includes accounts from pixelfed, pleroma.site, p3k.io, and mastodon. i thank diaspora for blazing the trail. the second wave will or maybe have already reached critical mass. #fediverse
Aaron Parecki
https://aaronparecki.com/
•
Jul 5
tl;dr The more I think about it, the more I think this parameter enables a use case that isn't really necessary. The me parameter in the code exchange step specifically allows for a token endpoint to be detached from both the Micropub endpoint and the authorization endpoint.
Full details below.
The different use cases that are all supported right now:
This is the simplest case in terms of architecture, but the most amount of work for a developer. In this case, someone writes all three parts of the system. Since they are part of the same system, the mechanism by which the token endpoint validates authorization codes does not need to be standardized, it's all internal.
Both my website and the Wordpress IndieAuth plugin fall under this case.
In this case, someone is building a CMS that includes a Micropub endpoint as well as a token endpoint. However, they want to speed up their development, so they use an authorization endpoint service such as indieauth.com.
The client sends the auth code to the token endpoint, and since the token endpoint is part of the CMS, it already knows the only place it can go to validate the auth code is the authorization endpoint service that it's configured to use. Therefore there is no need for the me parameter, which normally tells the token endpoint where to go to verify the auth code.
Specifically this case is where a service provides both an authorization endpoint and token endpoint. This is the quickest path to building a Micropub endpoint, since all you need to do is build out the Micropub endpoint itself, and when any requests come in with a token, the endpoint goes and checks whether the token is valid by testing it against the token endpoint service.
This is a very common case with peoples' individual websites, as it offloads the development and maintenance of the security bits to a service. I provide these as a service at indieauth.com and tokens.indieauth.com.
The interesting thing though is that when a single service provides both, there is also no need for the me parameter at the code exchange step, since the token endpoint already knows where it needs to verify the authorization code since the code was issued by the same system.
The only case where the me is needed is when the authorization endpoint and token endpoint are both used as services and they are separate services. Imagine a standalone token endpoint service: the job of this service is to verify authorization codes and issue access tokens, and later verify access tokens. In this situation, a request comes in with an unknown authorization code and it needs to verify it. Since it was not part of the system that issued the code, it needs to know how to verify it. Right now, this is enabled because this request also includes the me parameter, so the token endpoint goes and looks up the user's authorization endpoint and verifies the code there.
The thing I'm realizing though is that this is really quite an edge case, and one that I don't think is actually very important. Typically someone who is building a Micropub endpoint themselves will first start by using an authorization/token endpoint service, and there is no benefit to them if those are two separate services. In fact it's probably easier if they are just part of the same system since it's less moving parts to think about at this stage.
Later, that person can decide they want to take over issuing tokens, but still don't want to build out the UI of an authorization service. At this point, they fall under the second use case above. They build out a token endpoint into their software, and since they're using the authorization endpoint service they know where to verify authorization codes.
On the other end of the spectrum, you have people who build the whole thing out themselves, like my website and the Wordpress plugin. In these cases the me is completely irrelevant in the code exchange step.
The particular situation that the me enables is using a separate service for the authorization and token endpoints, and I can't think of a case where that is actually important.
Here's a quick survey of current implementations of token endpoints:
me parameter exists, but does not use it for anythingme parameter exists, but does not use it for anything sourceme parameter detailsme parameter sourceme parameter sourceme parameter sourceme in the request. not strictly necessary since it ends up using the me that is stored with the authorization code anyway. sourceme parameter exists, but does not use it sourceme to find the authorization endpoint to verify the code source
me to find the authorization endpoint, but only allows a whitelisted set of endpoints to be used source readme
me parameter enables this feature.
00dani
https://github.com/00dani
•
Jun 26
An alternative possibility would be to prescribe the format of IndieAuth access codes, as part of the standard. For instance, we could prefix the usual arbitrary implementation-specific access code blob with the expected me value, making it easy for token endpoints to discover the correct authorization endpoint. code=https://00dani.me/$C5r1cuqJk1fUTGrWX4DPHz44jxpgHF or something like that. Then, of course, pure OAuth 2.0 clients would pass through that extra piece of information with no trouble whatsoever, since it's embedded in an existing standard parameter.
It's certainly a messy approach, though, and one might question whether OAuth client compatibility is worth adding this complexity to IndieAuth. Additionally, making a change like this now would introduce potential incompatibility: a token endpoint that knows it can pull information out of the access code might still receive an access code from an authorization endpoint that doesn't embed information in the prescribed format, for instance.
Still, prescribing a format for access codes might not be quite as unreasonable as it seems: after all, client IDs are also treated as opaque in pure OAuth 2.0, whereas in IndieAuth they have a prescribed and meaningful format.
tl;dr The more I think about it, the more I think this parameter enables a use case that isn't really necessary. The me parameter in the code exchange step specifically allows for a token endpoint to be detached from both the Micropub endpoint and the authorization endpoint.
Full details below.
The different use cases that are all supported right now:
This is the simplest case in terms of architecture, but the most amount of work for a developer. In this case, someone writes all three parts of the system. Since they are part of the same system, the mechanism by which the token endpoint validates authorization codes does not need to be standardized, it's all internal.
Both my website and the Wordpress IndieAuth plugin fall under this case.
In this case, someone is building a CMS that includes a Micropub endpoint as well as a token endpoint. However, they want to speed up their development, so they use an authorization endpoint service such as indieauth.com.
The client sends the auth code to the token endpoint, and since the token endpoint is part of the CMS, it already knows the only place it can go to validate the auth code is the authorization endpoint service that it's configured to use. Therefore there is no need for the me parameter, which normally tells the token endpoint where to go to verify the auth code.
Specifically this case is where a service provides both an authorization endpoint and token endpoint. This is the quickest path to building a Micropub endpoint, since all you need to do is build out the Micropub endpoint itself, and when any requests come in with a token, the endpoint goes and checks whether the token is valid by testing it against the token endpoint service.
This is a very common case with peoples' individual websites, as it offloads the development and maintenance of the security bits to a service. I provide these as a service at indieauth.com and tokens.indieauth.com.
The interesting thing though is that when a single service provides both, there is also no need for the me parameter at the code exchange step, since the token endpoint already knows where it needs to verify the authorization code since the code was issued by the same system.
The only case where the me is needed is when the authorization endpoint and token endpoint are both used as services and they are separate services. Imagine a standalone token endpoint service: the job of this service is to verify authorization codes and issue access tokens, and later verify access tokens. In this situation, a request comes in with an unknown authorization code and it needs to verify it. Since it was not part of the system that issued the code, it needs to know how to verify it. Right now, this is enabled because this request also includes the me parameter, so the token endpoint goes and looks up the user's authorization endpoint and verifies the code there.
The thing I'm realizing though is that this is really quite an edge case, and one that I don't think is actually very important. Typically someone who is building a Micropub endpoint themselves will first start by using an authorization/token endpoint service, and there is no benefit to them if those are two separate services. In fact it's probably easier if they are just part of the same system since it's less moving parts to think about at this stage.
Later, that person can decide they want to take over issuing tokens, but still don't want to build out the UI of an authorization service. At this point, they fall under the second use case above. They build out a token endpoint into their software, and since they're using the authorization endpoint service they know where to verify authorization codes.
On the other end of the spectrum, you have people who build the whole thing out themselves, like my website and the Wordpress plugin. In these cases the me is completely irrelevant in the code exchange step.
The particular situation that the me enables is using a separate service for the authorization and token endpoints, and I can't think of a case where that is actually important.
Gargron
https://github.com/Gargron
•
Jul 6
Yep I just discovered that. Could just remove those particular tests...
Posts with no CW would end up with just a content property. According to the new parsing rules, those look just like normal content-only posts and sites don't see a name property and treat them as normal text/microblog/toot/tweet posts.
