#dev 2022-07-30

2022-07-30 UTC
#
gRegor Haven't finished reading yet, but some potential things for IndieAuth/OAuth implementations https://labs.detectify.com/2022/07/06/account-hijacking-using-dirty-dancing-in-sign-in-oauth-flows/
#
[tantek] But are you having the time of your life?
#
gRegor and I OAuth it all to you...
#
gRegor XD
#
[tantek] nice
#
aaronpk gRegor++
#
Loqi gRegor has 6 karma in this channel over the last year (44 in all channels)
#
aaronpk gRegor: where's that article come from? I have some comments to share with the author about some things that are inaccurate in it
#
[tantek] what is a car
#
Loqi It looks like we don't have a page for "car" yet. Would you like to create it? (Or just say "car is ____", a sentence describing the term)
#
[tantek] oops wrong channel
#
gRegor aaronpk, detectify.com, a vulnerability detection service one of our work clients uses
#
aaronpk At the end he says he sent a draft to the OAuth working group but I don't remember seeing that come through the list
#
omz13 angelo: I have updated toolbox.imoxia.com to give the client more detailed info when login fails, plus dumping the raw response from the AS into the server logs on my side... hopefully this can help locate the problem
#
aaronpk Well I just DMd the author
#
angelo omz13 i just tried again and it gave me "something bad happened downstream: EOF"
#
omz13 angelo: can you try again? the backend was temporarily offline... it should be back now
#
GWG I'm still trying to come up with a better definition for subject for the ticket endpoint?
#
omz13 GWG, something like: the subject is the principal party in a transaction (the fully qualified/normalized IndieWeb "me")
#
GWG omz13: In your proposed spec, you define it as the user profile of the subject. The Ticket Auth wiki page describes it as 'the access token should be used when acting on behalf of this URL'
#
GWG I think we could flesh it out a bit.
lagash joined the channel
#
GWG It doesn't explain what it is used for
#
GWG The ticket is sent with a resource and a subject. Discovery uses the token endpoint of the resource. The subject's use primarily seems to be to identify the person the ticket is for if there are multiple people using 1 ticket endpoint.
#
omz13 A subject is typically the first party, identified as a URI to their fully-qualified and normalized user profile page
#
omz13 subject is a more formal way of saying IndieWeb "me"
#
GWG omz13: We aren't using me in this context because the person sending isn't the me in question.
#
GWG So, that would make subject when we are referring to the me who will be claiming the token we're offering.
#
omz13 user profile == indieweb "me"
#
omz13 subject is the first party, not necessarily the party making the request when a third-party is doing an on-behalf-of request
#
GWG I understand, I just am looking for the right combination of words.
#
omz13 "The subject (claim) identifies the principal that is the subject of the <ticket/thing/whatever>."
#
omz13 or something like that
#
omz13 If you start reading the related RFCs madness will ensure... the nomenclature is consistent, except when it isn't
#
omz13 I did read one ID or RFC that was pretty good with these definitions, but I can't recollect which one it was
gRegorLove_, [tw2113_Slack_], BodyScrub, cjw6k, geoffo and tetov-irc joined the channel
#
IWDiscordGateway <capjamesg> TIL you can add p-name to a title tag.
[jgmac1106], gxt__ and chenghiz_ joined the channel
#
GWG When doing a password entry form, have they come up with a better way to show a password then JS toggling the form type from password to input?
#
aaronpk i've seen a small version of the password copied beloww the password input field
#
GWG I have a page of fields to enter an API key for a service. I wanted to redesign it and thought of using the JS trick.
#
GWG After I accidentally showed it during an IWC on video.
angelo and geoffo joined the channel
#
[schmarty] anyone here implemented an IndieAuth metadata endpoint? how about a client that uses it? i know i'm late to the game since it was added to the spec in Dec 2020 but it seems like we have no documented examples.
#
[schmarty] it seems that the only token verification mechanism in the spec now is via introspection endpoint, and the introspection endpoint "must" require some form of authorization. for now i am supporting "Bearer" in my setup, but i realize that introduces a challenge for services like Aperture which is built to support multiple users and their indieauth implementations.
#
[schmarty] new user setup requires giving aperture whatever it needs to auth itself to the introspection endpoint and that process isn
#
[schmarty] 't in the IndieAuth spec as far as i can tell...
#
aaronpk omg has it been that long already?
#
sknebel !march
#
Kaja It's March 882, 2020 (UTC)
#
aaronpk my plan was to give people a setup screen in Aperture where you could give it a way to authenticate to that endpoint, but i haven't touch Aperture since that update
#
sknebel (is the token itself a valid answer for "a form of authorization"? "this token authorizes whoever holds it to find some information about this token"?)
#
[schmarty] sknebel: 😂 i'd argue that is what the older just-give-this-to-the-token-endpoint method is asserting
#
sknebel sure
#
sknebel but I feel like something like that is kind of needed
#
aaronpk that is technically allowed yes lol
#
sknebel even if just to be able to check "is my token still good"
#
aaronpk the question is do you want to allow arbitrary software to validate tokens you issue? or do you want to explicitly authorize these things? this is the main way indieauth diverges from the model that oauth sets up
#
sknebel "this token is still good" is IMHO sufficiently useful to allow it. doesnt necessarily have to reveal all the other details the token holder should already know?
[Jamie_Tanna] joined the channel
#
[Jamie_Tanna] Schmarty I've got the metadata endpoint, and I'm using it in micropub-go for discovery (as is anyone using hawx's indieauth Go library), but that's pretty limited usage so far
#
[schmarty] the initial token fetch includes an expiry so in some ways the only thing a client might need to ask is whether the token has been revoked before its expiration, i think?
#
[schmarty] jamietanna++ ah nice, thanks! i'll take a look at how things are done there.
#
Loqi jamietanna has 6 karma in this channel over the last year (14 in all channels)
#
[Jamie_Tanna] For services I write I'd issue them client creds, although I've not technically done that yet for introspection so it's technically not secured fully
#
aaronpk the client doesn't need to know anything about tokens
#
aaronpk the client will find out a token was revoked when it goes to use it and that fails
#
[Jamie_Tanna] https://github.com/hawx/indieauth/pull/2 for the code adding support
#
Loqi [jamietanna] #2 Add support for IndieAuth Metadata endpoint
#
[schmarty] amazing, thanks!
#
sknebel "the client will find out a token was revoked when it goes to use it and that fails" - now I want to go check which micropub clients handle that gracefully, i.e. not throwing away the post-in-progress
#
aaronpk 😬
#
aaronpk quill should, since it has local storage of drafts
#
[schmarty] hehehe i was thinking the same 🙈
#
sknebel (although one can seriously argue if "return to client, get prompted 'hey I need you to login again'" or "reutrn to client, write post, post, get login prompt" is better UX, so maybe thats not a that good argument)
#
[Jamie_Tanna] https://github.com/search?q=%22indieauth-metadata%22&type=code shows a few places that may implement metadata
#
sknebel (especially since "oh my token is invalid" is really kind of similar to "oh, lost network" etc when it comes to what you need to handle it)
#
[Jamie_Tanna] Micropublish handles 401s and shows an error, but keeps the draft available on the page
#
GWG I'd love a client to ensure my implementation of the latest works
#
GWG I think omz13 calculated that because of the WordPress plugin, the majority of metadata endpoints are WordPress installs
#
[schmarty] GWG++
#
Loqi GWG has 18 karma in this channel over the last year (72 in all channels)
#
GWG [schmarty]: That's why I continue with WordPress despite my frustrations
#
GWG I have a few indieauth items to work on at some point too
#
omz13 There are, AFAIKT, about 6 implementations, pus the Wordpress plugin, who offer a metadata endpoint
#
omz13 FWIW, https://toolbox.imoxia.com/#authmetadisco can be used to lint a metadata file
#
omz13 and the resource fetcher in toolbox prefers endpoint discovery via metadata over rel links... https://toolbox.imoxia.com/#endpointdisco
#
omz13 at some stage I'll open up an API to toolbox; it will need an access key and, for kicks and giggles, I've implemented device flow to allow a cli to get it (which works surprisingly well but was an absolute PITA to have a smooth UI/UX)
#
GWG omz13: But not enough clients yet
#
omz13 GWG, chicken meet egg
#
GWG We have eggs
#
omz13 toolbox is technically a chicken and an egg (depending on what its doing)
#
GWG I thought the toolbox neither chicken nor egg
#
GWG I thought client and endpoint were
#
[schmarty] i've got a general indieauth device flow proxy at https://veil-mirror.glitch.me/ that works pretty will with aaronpk's example CLI https://github.com/aaronpk/Device-Flow-Proxy-Server/blob/main/client.php
#
Loqi Bimini
#
omz13 GWG, perhaps its best to think of toolbox as a mélange: it does some client things; it does some server things; it is a public and protected resource server; it is a full authorization server
#
[schmarty] thinking about adding dynamic "app" pages to make it easy for client_id / redirect_uri requirements to line up
#
omz13 for example, toolbox as a private resource server: https://toolbox.imoxia.com/private/codecow will gate you, until you login... the more interesting bit are the headers it exposes, particularly www-authenticate
#
GWG omz13: I think we're on different poultry farms again
#
omz13 GWG poultry is out, its all plant-based now :-)
#
GWG omz13: I was more talking about the need for a plurality of implementations
#
omz13 GWG, plurality of implementations is good!
#
omz13 angelo, if you are around tomorrow for create day, I'm free at the start if you want to try some login debugging
#
angelo omz13 sounds good, i'll be there
#
IWDiscordGateway <capjamesg> I’ll stop by tomorrow too!
#
IWDiscordGateway <capjamesg> I need an idea of something to build though…
AramZS and [snarfed] joined the channel
#
[snarfed] omz13 "embedded resource embedded::GATE/src/.gohtml NX" 😆
tetov-irc joined the channel
#
omz13 [snarfed] thanks... excuse me while I reprogram my server with a large axe
#
omz13 [snarfed] it looks like you successfully identified yourself... and then a csrf checked failed; if you visit the root https://toolbox.imoxia.com/ are you into the main site?
geoffo joined the channel