@oplik0 and I are having a discussion regarding the conditions upon which origin checking should be done on S2S activity receipt.

The spec says this:

Servers should not trust client submitted content, and federated servers also should not trust content received from a server other than the content's origin without some form of verification.

Reasonable, if a little open-ended. I took this to mean that if an Activity(Object) is received, if Object is a copy of the resource itself, that origin checking is required. This is reflected currently in the NodeBB code where if typeof object !== 'string' then origin check is carried out.

Problem is, that's a code smell. It's not readily apparent why an origin check is only carried out under that condition. Compounding this is that not all activities need an origin check: Create, Update, and Delete typically don't (careful in my wording here, lest I say something way off-base).

@oplik0 advocates for a more explicit approach, where perhaps an object uri is dereferenced regardless, and an origin check is carried out if the specific Activity-Object type pair calls for it (and if the uri doesn't match).

P.S. Yes, @hrefna@hachyderm.io I know object can also be an Array... or undefined... or null... don't @ me!)

[Capitole du Libre] Présentation de l'instance Peertube s2s, 100% LSF

https://peertube.s2s.video

Et voilà le flyer de Sign to sign, s2s, achevé par mes petites mains ​​
Bon j'espère qu'aucune faute n'a échappé à ma vigilance et malheureusement je suis connu pour en faire énormément ​​

Ceci dit, nous sommes prêt ​​ ​​

@pi_sourd@jlai.lu #s2s #Peertube #LSF #Sourd #CapitoleDuLibre #CapitoleDuLibre2023