Conversation

Notices

1. Embed this notice
   marius (mariusor@metalhead.club)'s status on Saturday, 21-Feb-2026 03:52:48 JST marius

   • Emelia 👸🏻
   • 🫧 socialcoding..
   • Evan Prodromou
   • Steve Bate
   • Ben Pate 🤘🏻

   @thisismissem it's not explicitly saying to forward authorization, but to me that's implied from "require authentication":

   proxyUrl: Endpoint URI so this actor's clients may access remote ActivityStreams objects which require authentication to access

   https://w3c.github.io/activitypub/#proxyUrl

   @evan @benpate @steve @smallcircles

   • Embed this notice
     Evan Prodromou (evan@cosocial.ca)'s status on Saturday, 21-Feb-2026 03:52:46 JST Evan Prodromou

     in reply to

     • Emelia 👸🏻
     • 🫧 socialcoding..
     • Steve Bate
     • Ben Pate 🤘🏻

     @mariusor I have implemented it requiring OAuth on one side and using HTTP Signature on the other. I think you need to use the user's authorization for private content or to respect personal blocks. It sucks for caching but ¯\_(ツ)_/¯

     @thisismissem @benpate @steve @smallcircles

   • Embed this notice
     Ben Pate 🤘🏻 (benpate@mastodon.social)'s status on Saturday, 21-Feb-2026 04:16:48 JST Ben Pate 🤘🏻

     in reply to

     • Emelia 👸🏻
     • 🫧 socialcoding..
     • Evan Prodromou
     • Steve Bate

     Yeah, this is how I'd expect it to work (with the possible addition of *also* allowing cookie auth on the client side)

     But yeah. Locally authenticated user from my client -> my server, then HTTP signature from my server -> your server

     @evan @mariusor @thisismissem @steve @smallcircles

   • Embed this notice
     Evan Prodromou (evan@cosocial.ca)'s status on Saturday, 21-Feb-2026 04:16:48 JST Evan Prodromou

     in reply to

     • Emelia 👸🏻
     • 🫧 socialcoding..
     • Steve Bate
     • Ben Pate 🤘🏻

     @benpate

     With all the standard warnings around proxies!

     @mariusor @thisismissem @steve @smallcircles