Skip to content

Add HTTP signatures to WebFinger requests #2594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
obenland wants to merge 2 commits into from
Closed

Add HTTP signatures to WebFinger requests #2594

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6017a39
Add HTTP signatures to WebFinger requests
obenland Dec 5, 2025
73127ca
Add changelog
matticbot Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/changelog/2594-from-description
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
Significance: patch
Type: fixed

Mentions now work with GoToSocial and other platforms that require signed requests.
16 changes: 9 additions & 7 deletions includes/class-webfinger.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,14 +215,16 @@ public static function get_data( $uri ) {
\rawurlencode( $identifier )
);

$response = \wp_safe_remote_get(
$webfinger_url,
array(
'headers' => array( 'Accept' => 'application/jrd+json' ),
)
);
$set_accept_header = function ( $args ) {
$args['headers']['Accept'] = 'application/jrd+json';
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The filter function directly assigns to $args['headers']['Accept'] without checking if the 'headers' key exists. If $args['headers'] is not set, this will create it, but it's safer to check or use array merging to avoid potential issues with existing header configurations.

Suggested change
$args['headers']['Accept'] = 'application/jrd+json';
if ( ! isset( $args['headers'] ) || ! is_array( $args['headers'] ) ) {
$args['headers'] = array();
}
$args['headers'] = array_merge( $args['headers'], array( 'Accept' => 'application/jrd+json' ) );

Copilot uses AI. Check for mistakes.
return $args;
};

\add_filter( 'http_request_args', $set_accept_header );
$response = Http::get( $webfinger_url );
\remove_filter( 'http_request_args', $set_accept_header );

Comment on lines +218 to 226
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a global filter for a single HTTP request creates a potential race condition in concurrent scenarios and affects all HTTP requests during execution. Consider passing headers directly to Http::get() if the method supports it, or use a more specific filter with priority to minimize side effects.

Suggested change
$set_accept_header = function ( $args ) {
$args['headers']['Accept'] = 'application/jrd+json';
return $args;
};
\add_filter( 'http_request_args', $set_accept_header );
$response = Http::get( $webfinger_url );
\remove_filter( 'http_request_args', $set_accept_header );
// Set Accept header directly in the request arguments to avoid global filter side effects.
$response = Http::get( $webfinger_url, array(
'headers' => array(
'Accept' => 'application/jrd+json',
),
) );

Copilot uses AI. Check for mistakes.
if ( \is_wp_error( $response ) || \wp_remote_retrieve_response_code( $response ) >= 400 ) {
if ( \is_wp_error( $response ) ) {
Copy link

Copilot AI Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removal of the HTTP status code check || \wp_remote_retrieve_response_code( $response ) >= 400 means that 4xx and 5xx HTTP errors will no longer be caught and converted to WP_Error. This could allow invalid responses (like 404 or 500) to proceed to parsing, potentially causing downstream errors. The status code validation should be retained alongside the WP_Error check.

Suggested change
if ( \is_wp_error( $response ) ) {
if ( \is_wp_error( $response ) || \wp_remote_retrieve_response_code( $response ) >= 400 ) {

Copilot uses AI. Check for mistakes.
return new \WP_Error(
'webfinger_url_not_accessible',
__( 'The WebFinger Resource is not accessible.', 'activitypub' ),
Expand Down