Reject unsupported HTTP Message Signatures

changelog.d/activitypub-bot-rfc9421-fallback.fix

@@ -0,0 +1 @@
+Reject unsupported RFC 9421 inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.

lib/pleroma/web/activity_pub/activity_pub_controller.ex

@@ -353,15 +353,21 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
   end
 
   def inbox(%{assigns: %{valid_signature: false}} = conn, params) do
-    Federator.incoming_failed_signature_ap_doc(%{
-      method: conn.method,
-      req_headers: conn.req_headers,
-      request_path: conn.request_path,
-      params: params,
-      query_string: conn.query_string
-    })
+    if unsupported_http_message_signature?(conn) do
+      conn
+      |> put_status(:unauthorized)
+      |> json("error, unsupported HTTP Message Signature")
+    else
+      Federator.incoming_failed_signature_ap_doc(%{
+        method: conn.method,
+        req_headers: conn.req_headers,
+        request_path: conn.request_path,
+        params: params,
+        query_string: conn.query_string
+      })
 
-    json(conn, "ok")
+      json(conn, "ok")
+    end
   end
 
   # POST /relay/inbox -or- POST /internal/fetch/inbox
@@ -381,6 +387,17 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
     |> json("error, missing HTTP Signature")
   end
 
+  defp unsupported_http_message_signature?(conn) do
+    Plug.Conn.get_req_header(conn, "signature-input") != [] and
+      not cavage_signature?(conn)
+  end
+
+  defp cavage_signature?(conn) do
+    conn
+    |> Plug.Conn.get_req_header("signature")
+    |> Enum.any?(&Regex.match?(~r/(^|,)\s*keyId\s*=/, &1))
+  end
+
   defp post_inbox_relayed_create(conn, params) do
     Logger.debug(
       "Signature missing or not from author, relayed Create message, fetching object from source"

test/pleroma/web/activity_pub/activity_pub_controller_test.exs

@@ -757,6 +757,83 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
       assert Activity.get_by_ap_id(data["id"])
     end
 
+    test "rejects unsupported HTTP Message Signatures so clients can fall back", %{conn: conn} do
+      data = %{
+        "type" => "Create",
+        "actor" => "https://activitypubbot.example/user/ok",
+        "id" => "https://activitypubbot.example/activities/rfc9421-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => "https://activitypubbot.example/objects/rfc9421-note",
+          "actor" => "https://activitypubbot.example/user/ok",
+          "attributedTo" => "https://activitypubbot.example/user/ok",
+          "content" => "hello from activitypub-bot",
+          "published" => "2026-05-29T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> false end)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Fri, 29 May 2026 13:33:31 GMT")
+        |> put_req_header("content-digest", "sha-256=:fake-digest:")
+        |> put_req_header(
+          "signature-input",
+          "sig1=(\"@method\" \"@target-uri\" \"date\" \"content-type\" \"content-digest\");keyid=\"https://activitypubbot.example/user/ok/publickey\";alg=\"rsa-v1_5-sha256\";created=1780061611"
+        )
+        |> put_req_header("signature", "sig1=:fake-signature:")
+        |> post("/inbox", data)
+
+      assert "error, unsupported HTTP Message Signature" == json_response(conn, 401)
+      assert [] == all_enqueued(worker: SignatureRetryWorker)
+    end
+
+    test "keeps failed-signature retry for legacy signatures with Signature-Input", %{conn: conn} do
+      data = %{
+        "type" => "Create",
+        "actor" => "https://activitypubbot.example/user/ok",
+        "id" => "https://activitypubbot.example/activities/legacy-create",
+        "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+        "cc" => [],
+        "object" => %{
+          "type" => "Note",
+          "id" => "https://activitypubbot.example/objects/legacy-note",
+          "actor" => "https://activitypubbot.example/user/ok",
+          "attributedTo" => "https://activitypubbot.example/user/ok",
+          "content" => "hello from activitypub-bot",
+          "published" => "2026-05-29T13:33:31Z",
+          "to" => ["https://www.w3.org/ns/activitystreams#Public"],
+          "cc" => []
+        }
+      }
+
+      Mox.expect(Pleroma.StubbedHTTPSignaturesMock, :validate_conn, fn _conn -> false end)
+
+      conn =
+        conn
+        |> put_req_header("content-type", "application/activity+json")
+        |> put_req_header("date", "Fri, 29 May 2026 13:33:31 GMT")
+        |> put_req_header("digest", "SHA-256=fake-digest")
+        |> put_req_header(
+          "signature-input",
+          "sig1=(\"@method\" \"@target-uri\" \"date\" \"content-type\" \"digest\");keyid=\"https://activitypubbot.example/user/ok/publickey\";alg=\"rsa-v1_5-sha256\";created=1780061611"
+        )
+        |> put_req_header(
+          "signature",
+          "keyId=\"https://activitypubbot.example/user/ok#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest content-type\",signature=\"fake-signature\""
+        )
+        |> post("/inbox", data)
+
+      assert "ok" == json_response(conn, 200)
+      assert [_] = all_enqueued(worker: SignatureRetryWorker)
+    end
+
     test "does not create a forged post after failed signature retry", %{conn: conn} do
       alice = insert(:user, local: false, ap_id: "https://one.com/users/alice")
       bob = insert(:user, local: false, ap_id: "https://two.com/users/bob")