silverpill@arcanicanis Until recently the only guidance on HTTP signatures was a post in Mastodon blog from 2018 or so. This is what I relied upon to get it working back then when I started Mitra, and it appears that people still read it today.
So it's not surprising that many developers get it wrong (including myself lol).
Now we finally have a FEP draft: https://codeberg.org/fediverse/fep/pulls/257 (though there's a risk of it being abandoned).
All GNU social JP content and data are available under the