[pfefferle]

Fixes #

Proposed changes:

• Incoming signatures now have to sign the site the request is made out to: host for draft-cavage signatures, and @target-uri, @authority or host for RFC 9421 signatures.
• When a request has a body, the signature has to cover its digest (digest or content-digest), and the header has to be sent.
• A Digest or Content-Digest header is now compared with the body whenever it is sent, also for an empty body.
• The security-audit agent got the rule for both verifiers.

Other information:

• Have you written new tests for your changes, if applicable?

I checked which headers other implementations sign. For draft-cavage, Mastodon, Misskey, GoToSocial, Lemmy, Pixelfed, PeerTube and Friendica all sign host, and digest on POST. For RFC 9421, Mastodon, Fedify, Bonfire and tootik all cover @target-uri, and content-digest with a body. Mastodon and tootik already reject RFC 9421 signatures without @target-uri, and Mastodon requires a signed digest on POST. So this should not break federation with them. I did not check Hubzilla, streams and Forte.

Testing instructions:

• Run vendor/bin/phpunit --filter 'requires_covered_components|requires_signed_headers'. The new cases sign by hand, because the plugin's own signer always signs everything.
• Follow a remote account from Mastodon and reply to a post, to check that normal deliveries still verify.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message