#dev 2021-11-05

2021-11-05 UTC
KartikPrabhu, nertzy_, strugee, alex11, Seirdy, hendursa1, [jgmac1106]1, IWSlackGateway, IWSlackGateway4, [tantek]1, moose333, kogepan and [Paul_Walk] joined the channel
#
[Paul_Walk] ↩️ That has been precisely my experience too
schmudde, tetov-irc, capablecable[d], kimberlyhirsh[d], ralismark[d], sayanarijit[d], _hepphepp[d], System[d], indieweb-irc-bri, tracydurnell[d], Zegnat[d], marksuth[d], daiyi[d], akevinhuang, P1000[d] and shoesNsocks joined the channel
#
@Cambridgeport90 ↩️ I'm also going to subscribe to your RSS feed, too. (You should make that interactive via the Webmention Wordpress plugin. That way you can get conversations started from across the web. being a writer and all...) (twitter.com/_/status/1456619674335125504)
kogepan_ and [jacky] joined the channel
#
[jacky] schmarty: I ended up going with just tokens but I was thinking of storing the header value of 'Set-Cookie' and using that to send back as `Cookie`. After doing some reading, that proved to be a bit of a janky approach (even if I used SessionStorage)
#
@justincox ↩️ The shortcut does not require Toolbox Pro, or any of the other Shortcuts enhancement apps. And I’ll have to look into the Webmention plugin, I’m not aware of it. Thank you! (twitter.com/_/status/1456635210662035460)
[schmarty] joined the channel
#
[schmarty] jacky: it sounds like a weird approach! Like isn't that what the built-in browser cookie handling does? 😅
#
[jacky] indeed! but it seems like doing that with XHR requests isn't compatible (which makes sense with the advent of JWTs and the like)
#
aaronpk that definitely should be how it works normally with XHR too, you shouldn't have to do anything special
#
[jacky] hm, I'm doing something _very_ wrong then
#
[jacky] because I remember this working in other projects and at work
#
[schmarty] is it a cross-domain request? could be CORS or a need to set a flag to allow sending credentials.
#
[jacky] It technically is (from two localhost endpoints)
#
[jacky] I completely forgot about CORS tbh
#
[jacky] I'll try that tonight
#
[schmarty] https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials maybe?
#
[schmarty] CORS is definitely gonna interfere if it's two endpoints that appear different to the browser. you might also need the receiving endpoint to set a *`Access-Control-Allow-Credentials`* header
#
[schmarty] oh these docs are more comprehensive: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
#
[schmarty] sometimes i miss the messy old days of pjax
#
[jacky] I had `fetch` use `credentials: "include"` (which IIRC is the equivalent of withCredentials)
#
[jacky] this looks like it might be it tbh!
#
[schmarty] sounds like the right thing on the client side!
#
[schmarty] i'd check to see if the endpoint is sending Access-Control-Allow-Credentials and then see if the endpoint is getting receiving a Cookie header.
#
[schmarty] also lol i got my terminology messed up. i should have said sometimes i miss the messy old days of jsonp
#
[jacky] ha
#
[jacky] just want this indieauth server to get to a point where I can give people a binary to run and it does everything else
#
[schmarty] jacky++ sounds rad!
#
Loqi jacky has 17 karma in this channel over the last year (62 in all channels)
#
[schmarty] with my recent forced updates of some sta(b)le nodejs-based indieweb projects on glitch I am once again back on my BS of "what if composable expressJS plugins for indieweb building blocks?"
#
[jacky] heh that'd be perf
#
[jacky] tbh something I want is to do some "preflight" work to generate cached mf2-json forms of pages on my site (and only update it if it notices a change in its caching values)
#
[jacky] I could see something like that helping with rel=alt and clients that might not have a parser handy
#
capjamesg[d] jacky++
#
Loqi jacky has 18 karma in this channel over the last year (63 in all channels)
#
[jacky] quickly tinkered with this during lunch and it def worked (the `Access-Control` headers)!
#
[jacky] finally lol
akevinhuang joined the channel
#
[schmarty] 🎉
joshproehl, [tw2113_Slack_] and schmudde joined the channel
#
GWG !tell jamietanna Refreshed the introspection endpoint PR to utilize the metadata method for discovery
#
Loqi Ok, I'll tell them that when I see them next
vtvg, KartikPrabhu and jamietanna joined the channel
#
jamietanna Thanks GWG - I'll have a look
#
Loqi jamietanna: GWG left you a message 1 hour, 39 minutes ago: Refreshed the introspection endpoint PR to utilize the metadata method for discovery
#
GWG jamietanna: We got one PR in, I aim to get them all so we can write a celebratory blog post
#
jamietanna That would be good :) Only minor tweaks on token introspection, so unless anyone has strong thoughts against it, that can go
#
Zegnat I think this weekend might be the weekend I get back to my IndieAuth code. Anything specific I should make my focus, GWG?
#
GWG Zegnat: We just added a metadata endpoint, but wouldn't suggest you deprecate the header links for the other endpoints yet
#
GWG Returning the iss property in conjunction with that to prevent mixup attacks
#
GWG Refresh tokens?
#
GWG I don't know
#
GWG Introspection?
#
jamietanna Would be good to have another person using Introspection :)
#
Zegnat I am very interested in Introspection, true, that might be my focus!
#
Zegnat The more I have been thinking about the metadata the more I like it. It will be easier to build a thing completely separate from the website’s own engine if all people need to include is the one link in their head (or HTTP headers)
Seb[d] joined the channel
#
jamietanna I'm glad we're doing it now, before we have too many endpoints, and we can have a while where both options are available, but hopefully we'll get clients supporting the new means to nudge people over
#
Seb[d] what is Introspection?
#
Loqi It looks like we don't have a page for "Introspection" yet. Would you like to create it? (Or just say "Introspection is ____", a sentence describing the term)
#
Zegnat Seb[d]: https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
#
Zegnat It is where OAuth applications can ask for information about a token. Something that IndieAuth put on the token endpoint to solve.
#
Seb[d] Ah, yes, I see. https://github.com/indieweb/indieauth/pull/94
#
Loqi [dshanske] #94 Token Introspection
#
Zegnat As long as we are not starting to gatekeep the simple flows, all standard OAuth behaviour we can get in is a win in my book
kogepan joined the channel
#
jamietanna > gatekeep the simple flows
#
jamietanna what do you mean by that Zegnat?
#
Zegnat If for someone to write an endpoint that lets them login to the wiki, they need to setup multiple endpoint URLs following multiple OAuth specs, I feel like we failed the promise of the easy decentralised identity provider
#
Zegnat If that makes more sense :)
#
jamietanna ah gotcha, yeah that's fair - I guess with this it'd now be two endpoints instead of just one for that, but one "endpoint" can "just" be a static JSON file
#
jamietanna Still, more complex than just one!
#
Zegnat Yes, the metadata endpoint is a new one. But also not really? Because the metadata JSON could be hosted on the base authorization endpoint
#
jamietanna Also true :)
#
aaronpk Hopefully this makes it easier to set up since it's only 1 html tag now
#
[schmarty] in some ways it is only pushing the complexity around
#
aaronpk correct, hopefully onto the part that it's expected fewer people will build
#
aaronpk we don't expect everyone to build their own indieauth server into their site, so it'd be great if adding an existing indieauth server to your site was as simple as possible
#
[schmarty] possibly! this reminds me that i need to try and catch up on the last 2-ish years of iOS Shortcuts development and fix my IndieAuth- and Micropub- related shortcuts 😒
_wackycity[d], Saphire, astralbijection[, mackeveli_, benatkin, nsh, reed, LaBcasse[m] and diegov joined the channel
#
GWG I need to write a PR for the revokation endpoint next
EvanBoehs[m] joined the channel
#
Seb[d] [schmarty]: same boat here. Even Quill stopped working because my IndieAuth endpoint is too old
#
Seb[d] so much to do before Düsseldorf
#
Seb[d] ‘too old’ is probably ‘read the spec wrong years ago’ tbh
#
aaronpk there have been a couple updates that might break, and i will admit with quill and others i have been on the more aggressive side of keeping up with the spec vs compatibility
#
[jacky] getting people to understand rel=me is like trying to convince them that HTML exists and hasn't broke
#
[jacky] (this is in relation to the bluesky group)
#
[jacky] I want them to adopt rel=me mainly to make it easier to do Web sign-in\
jeremycherfas and daiyi[d] joined the channel
#
GWG aaronpk: As a reference implementation, Quill should always be up to spec
Seirdy and tetov-irc joined the channel