Post by @Edent@mastodon.social

2026-08-31 20:35 UTC

Hey, #Mastodon and #ActivityPub developers. How much skew do you allow before rejecting a message? I've just received something where the header is signed: Mon, 31 Aug 2026 20:09:54 GMT But the ActivityPub message was published: Mon, 31 Aug 2026 19:58:36 GMT That's a little over 10 minutes. Is that too much? Should I not care as long as the signature validates?

Replies (3)

@Edent@mastodon.social 2026-09-01 10:24

A weird #ActivityPub message from #Frendica. Signed on 2026-09-01 Published on 2026-03-02 That's a skew of six months! The message type is "Undo" - so they're undoing a like they sent in March. Is there *really* a worry about accepting requests like this? Given the message has been signed, what risk is there to replay attacks? Bug report at https://github.com/friendica/friendica/issues/16150

Open ##5103942
@fazalmajid@social.vivaldi.net 2026-08-31 20:38

@Edent@mastodon.social you'd be surprised how many servers don't have proper NTP sync enabled and can have system clocks off by *hours*.

Open ##5175093
@evan@cosocial.ca 2026-08-31 20:40

@Edent@mastodon.social activitypub.bot gives a tolerance of 5 minutes. https://github.com/evanp/activitypub-bot/blob/main/lib%2Fhttpsignatureauthenticator.js#L8

Open ##5175094