Embed Notice

Added new requirements to FEP-ef34:

https://codeberg.org/fediverse/fep/pulls/672

Previously the FEP put the burden of C2S validation solely on the originating server (producer), but I think it would be better to do corresponding security checks on the consumer side too:

- When fetching an object: verify that Content-Type includes one of the AP & AS media types.
- When verifying a signature: also perform same-owner check and verify key ownership.

Both are already considered good practices in the Fediverse.

I also attempted to clarify how fetching from origin (authentication) is related to access control (authorization).

#fep_fe34