Use a more explicit signature verification #1078
Conversation
This is a proposal to use the `permission_callback`, instead of a general hook, to verify signatures. The advantage is, that it is easier to enable/disable verification for specific endpoints this way. See #1077
|
@mediaformat any idea why we have not used it in the first place? |
The callbacks use is more granular but I think that makes sense! |
|
@Automattic/fediverse we really should merge this ASAP. I forgot that I enabled "Authorized-Fetch" in my test system, so it took me some time, to figure out, why the likes/repost widgets won't be displayed! |
Co-authored-by: Konstantin Obenland <[email protected]>
Co-authored-by: Konstantin Obenland <[email protected]>
|
I think 1cffea7 went a bit too far. My feedback was specifically about the |
|
oops, I think I have not checked the search/replace properly enough! 🫣 |
|
Do existing unit tests cover the change or should there be new ones added? |
|
@obenland there were test for all parts in the stack, but I added one that integrates all of them. |
This is a proposal to use the
permission_callback, instead of a general hook, to verify signatures.The advantage is, that it is easier to enable/disable verification for specific endpoints this way.
See #1077