From 918f8bba132eb27feb0a9175ff20d8ce83419ce6 Mon Sep 17 00:00:00 2001 From: Gaspard Wierzbinski Date: Sat, 5 Oct 2024 12:10:19 +0200 Subject: [PATCH] fix: bug: Remove old replay attack text --- app/signatures/page.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/signatures/page.mdx b/app/signatures/page.mdx index 0efbbdb..dacf888 100644 --- a/app/signatures/page.mdx +++ b/app/signatures/page.mdx @@ -19,7 +19,7 @@ Versia uses cryptographic signatures to ensure the integrity and authenticity of A signature consists of a series of headers in an HTTP request. The following headers are used: - **`X-Signature`**: The signature itself, encoded in base64. - **`X-Signed-By`**: URI of the user who signed the request, [or the string `instance $1`, to represent the instance, where `$1` is the instance's host](/entities/instance-metadata#the-null-author). -- **`X-Nonce`**: A random string generated by the client. This is used to prevent replay attacks. +- **`X-Nonce`**: A random string generated by the client. Signatures are **required on ALL federation traffic**. If a request does not have a signature, it **MUST** be rejected. Specifically, signatures must be put on: - **All POST requests**. @@ -155,4 +155,4 @@ const isVerified = await crypto.subtle.verify( if (!isVerified) { return new Response("Signature verification failed", { status: 401 }); } -``` \ No newline at end of file +```