2018-10-08 UTC
# 00:00 GWG It doesn't need to, it has the settings # 00:00 GWG Problem being a few scenarios, like logging into one site with another # 00:04 GWG I wonder how many people hit this issue # 00:17 aaronpk GWG: i'm not sure I understand why this is a problem # 00:17 aaronpk you know which user is logged in, so just make sure you return that user's URL in the token response # 00:19 GWG WordPress doesn't require you provide one # 00:19 GWG Which is what it does if you don't set the user URL # 00:19 aaronpk why are you trying to use the profile URL at all then? # 00:22 aaronpk if it is ever a URL on a different domain then you can't use it in the indieauth token response anyway # 00:22 aaronpk if you want to return the root URL of the wordpress site then that should be a plugin setting # 00:25 aaronpk essentially you should never be in a position where you need to turn a user-entered URL into a wordpress user ID # 00:27 aaronpk in indieauth, the user enters their website into the app so that the app can perform discovery on it to know where to send them. you can just completely ignore the "me" parameter in the first authorization request and user the current logged-in user ID instead. # 00:27 GWG aaronpk: There is also a feature in the Indieweb plugin that changes the author post url to display the user url for h-cards, but I need to make some fixes to that. # 00:28 aaronpk sure that's the opposite direction. that's turning a wordpress user into a URL # 00:28 GWG aaronpk: Why would I never be in a position to turn a URL into a user ID? # 00:28 GWG WordPress user URLs can change based on system settings? # 00:28 GWG aaronpk: The token has the user ID in it # 00:28 GWG I added it to solve this exact problem # 00:29 GWG The question being, if that is the case, how did [asuh] have a problem by entering in a URL that didn't match his site? # 00:29 GWG I definitely need to revisit that code # 00:29 aaronpk because the current code doesn't do what I described? # 00:31 GWG If you have your Micropub endpoint and your Indieauth token endpoint on the same server, what steps can you skip? # 00:32 miklb I think www vs no-www is a different issue # 00:32 GWG miklb: I'm going to address normalization of URLs as well. There's a section in the spec. # 00:33 miklb I'm just wondering if that's conflating with the situation aaronpk described # 00:33 GWG miklb: Yes, but since we're using it for matching, it is basically a string. # 00:33 aaronpk what i'm saying is you don't need to be doing matching # 00:34 aaronpk there is a situation where www vs no-www can cause a problem, but only if your site doesn't handle redirecting one to the other properly # 00:35 GWG aaronpk: I agree. I thought I eliminated the need for it if you are using the token endpoint, and it is only needed if you are using Indieauth.com, which [asuh] wasn't. # 00:35 aaronpk wait I also thought you removed the option to use indieauth.com # 00:35 GWG aaronpk: From the Indieauth plugin, yes # 00:35 GWG But if you don't install/activate it, the Micropub plugin uses indieauth.com # 00:35 miklb if I read asuh's issue comment, it was a situation where he was getting a redirect loop because of the attempt to match and mis-matching in the token, causing issues with the SSL cert # 00:36 GWG I'd like it if everyone used the Indieauth plugin, but I can't make them. # 00:36 GWG Actually, I could, but I think others would be unhappy # 00:37 [asuh] I forced the `www` on my site because of the redirect issue but my host still allowed both with and without. So I was logging into Quill using non-`www` # 00:37 miklb I think if they were merged and there was a hook to not use another provider it would be safe # 00:37 [asuh] but it wasn’t posting right because there was a forced www for the site that I’ve since removed # 00:38 miklb which does sound different than the matching issues, only compounded by it # 00:38 [asuh] there are probably plenty of sites that can resolve with and without `www` so micropub clients would need to figure out the preferred version of the site # 00:38 aaronpk if a website is served from both www and no-www, that isn't really something that the indieauth plugin needs to fix, that's a problem with that website # 00:39 Loqi aaronpk has 13 karma in this channel over the last year (316 in all channels) # 00:39 GWG aaronpk: Still trying to deal with it # 00:39 aaronpk from the internet's point of view, there are two different websites with the same content in that case, which has been a googele SEO no-no for many many years # 00:39 aaronpk pick either www or no-www and redirect the other to the one you want # 00:40 aaronpk that's done usually at the web server level, but sometimes there's a way to do that in an .htaccess file too # 00:40 [asuh] I’ll tell you, my host Dreamhost uses a default of “allow both to exist”. It’s only after reading and learning do I understand why to only use one or the other # 00:40 GWG miklb: I'd like less plugins, but there are cases on both sides. You need IndieAuth for Micropub, but not vice-versa. So, merging them is problematic. If I remove the fallback in Micropub to Indieauth.com, one plugin won't work without the other. # 00:40 [asuh] I imagine many hosts are the same. So I can see this continuing to be a problem if micropub takes off # 00:41 aaronpk [asuh]: my point is this is not unique to micropub/indieauth, it's an SEO thing too # 00:42 miklb and I concur that this was considered "standard" at least 10 years ago. # 00:42 aaronpk in wordpress' case, what does it return for the site_url if the site exists on both? # 00:42 GWG aaronpk: The site url is a setting, so whatever it is set to # 00:42 miklb what ever is entered into the site settings # 00:42 aaronpk ah so it may return www even for the no-www version of the site? # 00:43 aaronpk so if that's the case, this still should not end up showing up as a problem with the plugin. you should get an error from the app you're logging in to saying the domains don't match. # 00:44 GWG aaronpk: That's what I am going to put in. # 00:44 Loqi [dshanske] #113 Issue with Mismatched URLs # 00:44 GWG miklb: We use home_url. There was an issue with that we fixed previously. # 00:45 aaronpk GWG: does it make sense that your code should never be trying to convert a URL into a wordpress user ID? # 00:46 GWG aaronpk: The Indieauth plugin code yes. The Micropub indieauth code no # 00:46 aaronpk the micropub plugin only when not using the indieauth plugin right? # 00:46 GWG As I said, there is definitely something wrong if it is trying. It is only supposed to as a fallback # 00:46 aaronpk the indieauth plugin shouldn't have any code that does that # 00:47 GWG aaronpk: It's leftover from before I changed it. But if it is using it, it means something is wrong. # 00:47 GWG I need to revisit this if I ever want to get Micropub out the door. # 00:47 GWG And I need to fix this case in the Micropub plugin as well. # 00:48 GWG And, because the author post url hack is inside the Indieweb plugin, I have to look at that code too. # 00:49 aaronpk the indieauth plugin doesn't require the micropub plugin, so start with indieauth since you can get it to a state where it is correct # 00:49 GWG IndieAuth and Micropub both use a setting in Indieweb that declares a site to be a 'single author site'. # 00:50 GWG The Indieauth plugin now has a curl level test endpoint that I put in to work on this scenario specifically # 00:50 GWG It does nothing but respond positive or negative to requests # 00:51 GWG And you can now generate a token on the backend # 00:57 miklb feeling a little Déjà vu but I'll keep an eye out on the GitHub issues and test when I can. dougbeal|mb1 and [jgmac1106] joined the channel
# 01:17 [jgmac1106] this is a total shot in the dark, apologize for possible derailment, but when I ever issue a LetsEncrypt cert I am offered the chance for both www and no www. I always select both, think it is default for me. Could this cause problem? # 01:19 tantek__ I doubt it. it just means the cert *can* be used on either. doesn't mean you have to # 01:19 aaronpk if the website is configured to redirect one to the other, then you actually *want* a cert on both [eddie] and [tantek] joined the channel
# 04:51 GWG aaronpk: Wondering how I can improve the Indieauth.com url to user matching as well. [Rose], ben_thatmustbeme, [kevinmarks], [eddie], [Vincent], [chrisburnell], [jgmac1106], [tmiller], [cleverdevil], [tantek], [schmarty], [kiai], dougbeal|mb1, [manton], tantek__ and [asuh] joined the channel
# 21:50 [asuh] I think I’ve asked about this in the past but is there a utility or plugin available to import Tweets from Twitter’s exported file to WordPress? [chrisaldrich] joined the channel
# 22:01 [chrisaldrich] Similarly for Facebook which [cleverdevil] a a start on something if I recall. # 22:16 [asuh] Darn ok. I'm sure I'll forget I asked this in a few months and ask again! I can imagine it's not trivial to create this type of utility # 22:38 [jgmac1106] I have all my tweets saved in spreadsheets missing first year I had saved on TwapperKeeper Twitter never sends me archive [kiai] and [kevinmarks] joined the channel
aaronpk like /author/username or whatever
[jgmac1106] this is a total shot in the dark, apologize for possible derailment, but when I ever issue a LetsEncrypt cert I am offered the chance for both www and no www. I always select both, think it is default for me. Could this cause problem?
[chrisaldrich] [asuh] I'm not aware of one, but I'd love to see one!