e5481b4c28HTTPSignaturePlug checks the policy before the cryptographic check. A signed GET that fails it counts as unsigned; the inbox answers 401 to a POST that fails it instead of queueing a failed-signature retry, which only re-checks the signature. signature_policy: :log only logs. Based on Akkoma's HTTP signature hardening. |
||
|---|---|---|
| .. | ||
| config | ||
| credo/check/consistency | ||
| fixtures | ||
| instance_static | ||
| mix | ||
| pleroma | ||
| support | ||
| test_helper.exs | ||