From c8dcd5ee646af9f6b7682a4617c7fc088c8ac1f4 Mon Sep 17 00:00:00 2001 From: famfo Date: Mon, 24 Feb 2025 01:07:20 +0100 Subject: [PATCH] federation: add setting to disable HTTP signature validation --- modules/setting/federation.go | 2 ++ routers/api/v1/activitypub/reqsignature.go | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/modules/setting/federation.go b/modules/setting/federation.go index a0fdec228e..1eb078e996 100644 --- a/modules/setting/federation.go +++ b/modules/setting/federation.go @@ -19,6 +19,7 @@ var ( DigestAlgorithm string GetHeaders []string PostHeaders []string + SignatureEnforced bool }{ Enabled: false, ShareUserStatistics: true, @@ -27,6 +28,7 @@ var ( DigestAlgorithm: "SHA-256", GetHeaders: []string{"(request-target)", "Date", "Host"}, PostHeaders: []string{"(request-target)", "Date", "Host", "Digest"}, + SignatureEnforced: true, } ) diff --git a/routers/api/v1/activitypub/reqsignature.go b/routers/api/v1/activitypub/reqsignature.go index 7f704bae81..9a71bcf8e6 100644 --- a/routers/api/v1/activitypub/reqsignature.go +++ b/routers/api/v1/activitypub/reqsignature.go @@ -41,6 +41,10 @@ func getPublicKeyFromResponse(b []byte, keyID *url.URL) (p crypto.PublicKey, err } func verifyHTTPSignatures(ctx *gitea_context.APIContext) (authenticated bool, err error) { + if !setting.Federation.SignatureEnforced { + return true, nil + } + r := ctx.Req // 1. Figure out what key we need to verify