mastodon / mastodon

Your self-hosted, globally interconnected microblogging community
https://joinmastodon.org
GNU Affero General Public License v3.0
46.18k stars 6.76k forks source link

Fix Accept headers when fetching AP objects to match spec #30354

Open TheOneric opened 2 weeks ago

TheOneric commented 2 weeks ago

ActivityPub spec section 3.2 reads

The client MUST specify an Accept header with the application/ld+json; profile="https://www.w3.org/ns/activitystreams" media type in order to retrieve the activity.

Currently Mastodon omits the profile in its dereferences (but not the fetch service) and only lists application/ld+json as one of several possible types. This breaks spec and allows spec-compliant implementations to refuse any such fetch requests.

Resolve this by adding the required profile and while at it, make the only spec-compliant type the first listed choice in all relevant places.
While unlikely to be a problem due to other parts already including a profile, also keep a profile-less JSON-LD type where it existed before to ensure this doesn't break federation with a hypothetical buggy implemenetation relying on this current Mastodon quirk.

Section 7 also specifies the same media type MUST be used in the Content-Type header of for POST requests, but here we can't specify alternatives, so for now keep the current type.

Fixes a part of https://github.com/mastodon/mastodon/issues/22720


This is a more conservative alternative to #22722.

With the proper spec-compliant type now being the first choice on fetches at least, hopefully we’ll get less cases like https://github.com/mastodon/mastodon/pull/22722#issuecomment-1453434362

TheOneric commented 2 weeks ago

The CI failure for Ruby Testing / test(3.1) seems unrelated (API V2 Admin Accounts GET #index with limit param sets the correct pagination headers) and doesn't occur when running directly on the current commit: https://github.com/TheOneric/mastodon/actions/runs/9134282607/job/25133406209

Let me know if i missed and should fix something

renchap commented 2 weeks ago

This looks like to be a flaky test. Maybe @mjankowski want to have a look?

mjankowski commented 1 week ago

I don't see the failure at that link, but I think I found it here - https://github.com/mastodon/mastodon/actions/runs/9134408456/job/25122194677 - and yeah, might be a sort-order dependent intermittent failure ... will see if I can replicate locally.