#dev 2025-09-04

2025-09-04 UTC
#
gRegor I'm trying to get better about documenting changes I make on my site, even "small" ones. Helps during those HWC questions "anything new on your site?" haha. https://gregorlove.com/2025/09/i-made-a-small/
#
gRegor Also obligatory bridgy++ snarfed++
#
Loqi snarfed has 46 karma in this channel over the last year (75 in all channels)
#
[tantek] gRegor, more than once I've had to check my edit/contributions history on the indieweb wiki to look up what changes I made on my site when
#
gRegor haha, same
grufwub, barnaby, Luther_Gray, cotsuka, [morganm] and claudinec joined the channel
#
gRegor From IndieAuth server discussion in HWC now, anyone have thoughts on implementing PKCE in a serverless environment? benji is working on that and we're not sure how to keep state for the `code_challenge`
#
[snarfed] memcache or a database
#
Loqi Ok, I'll tell them that when I see them next
#
gRegor "
#
gRegor !tell capjamesg I think Alto is requesting more scope from Github than it needs, we noticed "Act as you" in the list. The indieauth.com app looks like it has "Access public information (read-only)
#
aaronpk You can also use an encrypted JWT to store stuff
#
aaronpk So if your authorization code is actually an encrypted JWT you can store the PKCE code challenge in it to be able to verify later. It's important that it's encrypted not just signed tho
#
gRegor Ahh, thank you
claudinec, gotra, bterry1, barnaby, [morganm], vidak, geoffo_, Guest6_, oodani, sarna, ttybitnik and [artlung] joined the channel
#
capjamesg Should a user be able to redeem the same `code` more than once at the token endpoint?
#
Loqi capjamesg: gRegor left you a message 11 hours, 12 minutes ago: I think Alto is requesting more scope from Github than it needs, we noticed "Act as you" in the list. The indieauth.com app looks like it has "Access public information (read-only)
#
aaronpk no
#
capjamesg Thanks for the confirmation.
#
capjamesg And to be clear, I can redeem `code` at _either_ /auth or /token? /auth says it's `me`, and `/token` lets me generate a Bearer token for the client? And the usage of the Bearer token is to call the /introspect endpoint to verify that a token is active?
gotra joined the channel
#
aaronpk that is the old non-OAuth compliant behavior. the new spec says to use it only at the token endpoint, the differece is whether a token is returned
#
capjamesg Wait so I don’t need to support the POST to the /auth endpoint for code redemption?
#
doesnm wait now authorization_endpoint don't need to accept post requests?
#
doesnm i had one crazy idea about serverless indieauth endpoint. Not sure if possible
#
GWG- aaronpk: How is client metadata going on the oauth side, by the way?
gotra joined the channel
#
aaronpk We just scheduled the interim meeting for it
#
aaronpk And there's a good chance MCP will adopt it, and several large OAuth providers would follow
[benji] joined the channel
#
[benji] Thanks [aaronpk] and [gRegorLove] for the help. Got things figured out with your help
thegreekgeek_ joined the channel
#
GWG- aaronpk: Any changes that might influence the indieauth version?
#
aaronpk if this gets adopted I do want to go full in on that method for client metadata for indieauth
barnaby joined the channel
#
capjamesg gRegor++ for the GitHub note earlier.
#
Loqi gRegor has 44 karma in this channel over the last year (120 in all channels)
#
capjamesg I had ticked a box that didn't need ticked.
#
capjamesg https://cdn.discordapp.com/attachments/866577430886350869/1413211791936196740/Screenshot_2025-09-04_at_18.18.58.png?ex=68bb1b8b&is=68b9ca0b&hm=4d7b5e2174bee238f3f88fd9f07a9eee743c59f5d1be12f70256f3aa5983b8d5&
#
capjamesg I think it was this one:
#
capjamesg "Request user authorization (OAuth) during installation"
#
capjamesg I _think_
claudinec and gRegor joined the channel
#
gRegor capjamesg, I'll try it out! Couple other small bits of feedback: from https://ragt.ag/guests we entered "pcarrier.com" without the http(s). When it passes through to Alto, the domain field isn't filled in
#
gRegor It could probably redirect to the page that shows the rel-me links it found instead of prompting for the domain again
#
capjamesg gRegor Heads up the site will be down for a few hours.
#
gRegor Just tried https://alto.jamesg.blog/login, it's still showing "Act on your behalf" in addition to "Verify your GitHub identity" and "Know which resources you can access"
#
gRegor (in the Github authz prompt)
#
capjamesg I have several improvements enqueued but a few bugs to fix.
#
capjamesg gRegor so weird.
#
gRegor Noticed the name fix on that prompt though, nice. "Alto Authentication"
#
capjamesg I need to look further.
#
gRegor Ooh, and the redirect says "Authorizing will redirect to
#
gRegor http://localhost:5070"
#
capjamesg Alto is so private it only deals with localhost 😂
#
gRegor haha
#
capjamesg I have that in temporarily while I debug.
#
gRegor Last bit of feedback (I figure you're working on it now haha):
#
capjamesg I am moving to use JWTs more. I was previously recording info both in a JWT and in the DB which was duplicative and adding lots of code that I didn't need.
#
capjamesg Yes! Feedback is really appreciated!
gotra joined the channel
#
gRegor clicking "cancel" in the github prompt sent back to the callback URL on Alto with the error query parameters, but the page is a 404
#
gRegor Generic nginx 404
gotra joined the channel
#
capjamesg gRegor it looks like the GitHub thing is out of my control: https://github.com/orgs/community/discussions/37117
#
capjamesg [edit] gRegor it looks like the GitHub thing is out of my control: https://github.com/orgs/community/discussions/37117
#
capjamesg I am literally requesting zero permissions in their app and they still list the "act on your behalf" item.
#
gRegor Very weird. Does it not apply to older apps? If you try indielogin.com with github rel-me, it shows a different prompt
#
gRegor (skimming the thread)
#
capjamesg Yeah it must not.
#
capjamesg This is no fun 🙁
#
gRegor Woof, the number of comments in this thread and being years old :/
#
capjamesg gRegor would you mind trying to sign in to something?
#
gRegor Sure. Though I have IndieAuth server on my site so often it defaults to using that rather than rel-me
#
capjamesg wait no
#
capjamesg One sec.
#
[tantek] I believe Bridgy causes a similar "act on your behalf" prompt when you enable it for Github POSSE/backfeed
#
capjamesg Okay it's up now
#
[tantek] That's a more recent example to compare to
#
capjamesg I have to work on the email flow.
#
gRegor capjamesg, you want me to sign in to Alto?
#
capjamesg Yeah!
#
[artlung] Has anyone else gotten an email from Amazon about "verifying your Amazon Appstore developer portal" ?
#
[artlung] > _As part of our ongoing efforts to keep the Amazon Appstore safe, we are requiring you to verify your identity in the Amazon Appstore developer portal. This verification process ensures a high-quality catalog that enhances customers' experience._
#
[snarfed] have you published an app in the amazon appstore? 😆
cotsuka joined the channel
#
gRegor capjamesg, mostly worked! Still redirected to https://alto.jamesg.blog/auth and showed JSON "invalid request". When I went to https://alto.jamesg.blog/, got a messy error page "jinja2.exceptions.UndefinedError: 'None' has no attribute 'get'
#
gRegor "
#
capjamesg gRegor Thank you!
#
capjamesg I'm getting close to something that's more polished.
#
capjamesg JWT keys now support JSON web encryption.
#
capjamesg gRegor mind trying again?
#
capjamesg aaronpk Do you remember what you demo'd at IWC Berlin last year? It was something to do with IndieAuth and the browser.
#
[artlung] So, I never did that [snarfed] but I feel like I investigated that when my music app employer was considering whether to do a specialized android app distributed through Amazon
cotsuka joined the channel
#
[artlung] This would be... 2014 or so. It feels late for them to be following up on it!
#
aaronpk Was it FedCM? I think I was playing with that at the time
CrimeWave joined the channel
#
capjamesg Yes, that was it!
#
capjamesg It would be cool if I could tell a service my domain name and if I'm signed in with my IndieAuth server and have signed in before automatically be taken back to the service.
#
capjamesg (i.e. removing the scope grant process if I have already granted a scope for that client)
#
capjamesg maybe this is already a thing?
failxontour and [Sophia_wood] joined the channel
#
[Sophia_wood] Is it normal to have to contact support to transfer a domain? I know you don't want accidental transfer, but I don't remember having to do this before.
#
[artlung] It *can* be for a very small registrar but the "unlock code" process is fairly formalized these days and I've not had to do anything like that in a while.
#
[Sophia_wood] this is with netlify - I just sent them a message to ask. I am trying to move to codeberg and working things out.
#
capjamesg Alto now supports email auth!
cotsuka joined the channel
#
capjamesg Artemis is now using ~200GB of storage. All in one sqlite file!
[aciccarello] joined the channel
#
[aciccarello] It wouldn't surprise me if Netlify didn't build out a full transfer flow since domains aren't their primary thing.
btrem joined the channel
#
btrem Is it possible to get a Let's Encrypt certificate for a docker container? I'm running Drupal in a ddev container, trying (still!) to get a ical feed working. And Thunderbird is complaining about certificates. (What's worse: it locks up every time the warning window pops up). :(
#
btrem I'm a relative novice, so keep that in mind. I've looked up how to run certbot in a container, but it's a bit complicated. Maybe beyond my (limited) skill set?
cotsuka joined the channel
#
[Sophia_wood] There is a flow…:(
#
[Sophia_wood] https://chat-uploads.indieweb.org/files/2025/09/dev-20250904-213756-img_3170.jpg
#
GWG- aaronpk: What would full in be? Didn't we add it?
Sigmundur_morkor joined the channel
#
aaronpk we did, but i feel like we haven't done the necessray push to get folks to adopt it in practice
Sigmundur_morkor joined the channel
#
capjamesg How can I tell if a rel=me link points to a Mastodon site?
#
capjamesg Hm, maybe looking up https://indieweb.social/.well-known/oauth-authorization-server and checking if the service documentation is the Mastodon docs?
#
capjamesg I have Mastodon OAuth working for my IndieAuth client but I need to know if a rel=me link is mastodon to use it.
#
capjamesg Actually maybe a curl to get the "Server" header would do.
#
gRegor Yeah I think you'd have to do some processing of each domain to determine if it's Mastodon unfortunately
rozodru joined the channel
#
aaronpk there are other mastodon-specific URLs you can check
#
aaronpk https://mastodon.social/nodeinfo/2.0
#
capjamesg Oh nice
#
capjamesg aaronpk Is it possible/reasonable/secure to bypass the consent screen if I have already granted permission to that service with my account in the past?
#
GWG- aaronpk: I waa trying to figure out of I could get my indieauth endpoint to work somehow with Immich, which supports oauth
#
aaronpk capjamesg: if you can be certain of the identity of the application then yes. OAuth considers a registered https redirect URI to be sufficient for that purpose.
#
aaronpk basically you want to avoid the situation where someone can click a malicious link and their indieauth server immediately issues an access token to the malicious server
#
aaronpk so if the redirect URI is localhost, there is no way to know which application will actually be getting tokens, so you need to prompt the user
sknebel and Zegnat joined the channel
#
[tantek] capjamesg, re: "can I tell if a … link points to a Mastodon site", check how existing open source Mastodon clients do it, when the user enters their Mastodon server URL / domain!
#
[snarfed] capjamesg: https://swicg.github.io/activitypub-html-discovery/
rozodru joined the channel
#
[snarfed] if you know/determine it's a fediverse server, you can use nodeinfo to get the software, https://nodeinfo.diaspora.software/
#
[snarfed] or yolo fetch https://docs.joinmastodon.org/methods/instance/#v2 and check the... `source_url` field? 🤷