#dev 2025-11-02

2025-11-02 UTC
aaronpk, bterry, NaomiAmethyst, DanQ, grufwub, Florian1, barnaby, Pixi, [benatwork] and ttybitnik joined the channel
#
[schmarty] aaronpk: i am having trouble understanding something with http://indielogin.com. using it with my indieauth server. i see indielogin make an auth request with no scopes, seems good, but then it tries to redeem the code at my _token_ endpoint. since there were no scopes requested, my server barfs at this point. i believe that indielogin should only be making requests to the authorization endpoint?
#
[schmarty] https://indieauth.spec.indieweb.org/#request
#
aaronpk no that is a recent indieauth change to bring it more inline with oauth
#
aaronpk or at least i thought it was...
#
[schmarty] yeah i'm stuck a bit, here. should i give indielogin the benefit of the doubt and treat it _as if_ the request had gone to the authorization endpoint instead? i am also having trouble remembering exactly when this broke, but i think there was some recent indielogin maintenance?
#
aaronpk i recently added bluesky support
#
aaronpk oh and require PKCE for indielogin clients now
#
aaronpk looks like january was the change https://github.com/aaronpk/indielogin.com/issues/121
#
[schmarty] ah, wow, ok.
#
[schmarty] well i think the spec is pretty clear that if there are no scopes requested that this request ought to be going to the auth endpoint.
#
aaronpk i see a comment that we made the spec change tho
#
aaronpk but also i am not seeing the change
#
[schmarty] hmm, i'm not seeing that comment. and the spec still lists this breakdown: https://indieauth.spec.indieweb.org/#x5-3-1-request
#
aaronpk https://github.com/aaronpk/indielogin.com/issues/121#issuecomment-2571680458
#
Loqi [preview] [aaronpk] @janboddez yep that's another reason we moved this to separate the two endpoints, it's totally reasonable to use web middleware on the authorization endpoint that prevents API access
#
aaronpk and i do remember this discussion, the justification is people have been starting to want to use more generic OAuth libraries so we have been moving it to be more and more compatible with plain OAuth
#
[schmarty] hmm, i interpreted that comment as specifically supporting the split (profile-only requests to auth endpoint, token-for-resource-access requests to token endpoint)
#
aaronpk no definitely about moving to only the token endpoint
#
[schmarty] the advice to have indielogin, which is only requesting profile info, exchange the code at the token endpoint also goes against this section: https://indieauth.spec.indieweb.org/#access-token-response
#
aaronpk the other justification is the comment above that the authorization endpoint is for web browsers and might have middleware that does CSRF
#
[schmarty] ah, ok, yeah that clarifies the reasoning.
#
aaronpk that's so weird, i remember this conversation like it was a month ago but why didn't it ever make it into the spec update?
#
[schmarty] it seems like it affects multiple parts of the spec, so that might be part of it?
#
[schmarty] here are two possibilities i am looking at. first, i beg aaronpk to have indielogin request 'profile' scope, then everything is copacetic with the spec as-written.
#
[schmarty] second i am much less sure about, but it would be something like "rescuing" a request that looks like an invalid request for a token with empty scopes to treat it instead as if it was being handled by the old auth server behavior?
#
aaronpk i can definitely add profile scopes to it
fry02 joined the channel
#
aaronpk try know [schmarty]
Paula joined the channel
#
[schmarty] 🎉
#
[schmarty] https://chat-uploads.indieweb.org/files/2025/11/dev-20251102-164555-image_from_ios.jpg
#
[schmarty] aaronpk: totally works!!
#
aaronpk yay
#
[schmarty] aaronpk++ thank you! indielogin++
#
Loqi indielogin has 1 karma over the last year
#
Loqi aaronpk has 51 karma in this channel over the last year (131 in all channels)
proofreed joined the channel
#
[Jo] schmarty++ that counts as a win during the create day i think
#
Loqi schmarty has 14 karma in this channel over the last year (39 in all channels)
#
[Jo] I'm hoping to turn my small step toward indielogin into a win too during my train ride 🤞
#
[schmarty] [Jo] ++ haha, thanks, and have a plus for your bravery to try my rickety nginx/IndieAuth thing !
#
Loqi [Jo] has 5 karma in this channel over the last year (51 in all channels)
ttybitnik joined the channel
#
[tantek] For folks looking to setup alternative services, backends: https://european-alternatives.eu/
#
carrvo tantek++
#
Loqi tantek has 34 karma in this channel over the last year (154 in all channels)
#
carrvo aaronpk, if you are talking about compatibility with plain OAuth libs, mine requires the `sub` field to be populated buth IndieAuth populates `me`. I think I understand why, but my hands are tied with the lib.
#
carrvo Just a side note.
#
aaronpk yeah, that's something i want to tackle next
#
aaronpk tho do you really mean it requires `sub` in the token endpoint response? that isn't actually in any spec right now
[Jo]2, [Al_Abut]1, geoffo_, [Al_Abut]2, bterry1, Pixi`, DanQ1, Xe, proofreed, rrix, sp1ff`, [Jo]3, jak2k, vidak, rgbivvv and [jeremycherfas] joined the channel
#
carrvo Yes. It needs something to map to Apache's user field (passed down the pipeline) and it hardcodes the value to come from `sub`. No `sub`, no user, no successful match.
#
aaronpk what providers have you found that return `sub` in the token response? I ask because I was considering bringing that to the OpenID Connect working group to formalize it, but I wasn't aware of anyone that actually did that
#
[Jo]3 Can someone try to sign in on https://dead.garden/drwho and tell me what error they get (not expecting it to work for u but not for me)
#
carrvo I have some of it mentioned https://github.com/indieweb/wordpress-indieauth/pull/288 (I can't remember the best spot I documented it offhand.)
#
aaronpk [Jo]: i got an empty 401 response
#
Loqi [preview] [carrvo] #288 SUB claim for Pure OAuth client Compatibility
#
aaronpk carrvo: oh, mod_oauth2 is using token introspection to find the value, not expecting it in the token _response_?
#
carrvo My provider returns `sub`! I have seen it with OIDC where they return `sub`...
#
[Jo] Oh my
#
carrvo Oh, sorry. Yes, I confused introspection with the preceding response. 🙁
#
aaronpk ok that makes sense
#
aaronpk it would be nice to save the extra request and just return it directly like indieauth does
#
carrvo I only found one way to make IndieAuth + mod_oauth work. I know it was designed for mod_auth_oidc...
#
carrvo I think there was some "I don't care what the token looks like because I can ask the introduction for a standard format" but that was a year ago.
#
carrvo *introspection
#
aaronpk OAuth is intentionally not prescriptive about token formats, also the client is not supposed to know anything about the token format even if it has one.
#
carrvo That would have been it! But at the end of the day things need to collapse to some format understood by both sides. I understand that introspection does that for those libraries.
#
carrvo Sorry, this got really far into the weeds as to why I am currently stuck with the `sub` field. I *do* have a project to replace it...eventually...
[artlung], DanQ, rhyswynne, shoesNsocks, Florian1, mahboubine, Florian2, rosipov1, rrix and CrimeWave joined the channel
#
rgbivvv i just bought a little foldable bluetooth keyboard so that i can SSH into my server and write Markdown on the go on my phone :)
DanQ joined the channel
#
[Jo] nice
#
[Jo] i had to hack at my problem on my phone with my phone keyboard via ssh on the train (and train wifi), do not recommend
Xe joined the channel
#
[Jo] update: I did get login working with indieauth 🎉 but i wish it'd work as easily with selfauth, which is what i'd like to use. but something about the tokens is confusing it and it stops working properly
#
carrvo Jo, any specifics? I have some experience with wrangling SelfAuth specifically.
DanQ joined the channel
#
[Jo] Basically whenever I add token endpoints to my header selfauth stops working for me in all contexts (even ohttp://h.in the wiki login page); for http://tokens.indieauth.com I get invalid_request (Invalid code provided) and idk why
#
[Jo] whereas http://indieauth.com with external methods like email or github plays nice and works just fine as an authorization endpoint with the token endpoint