claudiavago
Forum Replies Created
-
Thank you so much, that’s really helpful — and the reasoning behind
?author={ID}makes complete sense (the deactivation-resilience point especially). No rush at all on my side: the site is stable and the plugin is active, I just can’t federate the blog profile yet, and I’m happy to wait for a proper solution rather than patch it with a fragile hack.If it helps your testing, my exact case is: “Blog profile only” mode, blog actor resolving to /?author=0, on WP Engine which blocks the
?author=query-string form (but allows pretty/author/permalinks). Glad to test any workaround or beta on my end whenever you have something — just let me know. Thanks again for taking the time!Thanks again @pfefferle. I’ve dug a bit deeper and I think I’ve narrowed down exactly where the collision is — hoping you can point me to the right hook.
Key detail: WP Engine’s author-enumeration protection blocks the query-string form
?author=(that’s what returns the 403), but the pretty-permalink form works fine. For example:- https://valori.it/?author=0 → 403 Forbidden
- https://valori.it/author/tecleme/ → works
My permalinks are set to pretty URLs. But WebFinger for the blog actor (acct:valori.it@valori.it) advertises the query-string form as its
selflink:“rel”: “self”, “type”: “application/activity+json”, “href”: “https://valori.it/?author=0”
I’m guessing this is because author id 0 is the blog/system actor, which has no pretty author page of its own, so it falls back to the numeric
?author=0form — which is exactly the form my host blocks.My questions:
- Is there a filter/hook in ActivityPub (or via your WebFinger plugin’s
webfinger_datafilter) that lets me override the blog actor’sselfURL so it points to its proper REST actor endpoint (e.g. /wp-json/activitypub/1.0/actors/0 or similar) instead of /?author=0? - Alternatively, is there a way to make the blog actor resolve via a pretty-permalink URL rather than the ?author= query string?
Either of those would sidestep the host block without weakening its security. If you can point me to the correct filter and the intended target URL, I can apply it via a small site-specific plugin. Thanks so much!
Thanks @pfefferle, that confirms what I’d traced too.
The difficulty is that I can’t get WP Engine to unblock the ?author= routes: I already asked them, and they declined because any exception to their author-enumeration protection would weaken site security. They did add an allow rule for the Mastodon User-Agent, but they won’t open up the ?author= URLs. And switching hosts isn’t a realistic option for us. So the host side is a dead end here.
Given that, is there anything that can be done on the plugin side? Specifically:
- In “Blog profile only” mode, is it expected that the blog actor resolves via /?author=0 at all? I’d have assumed the blog profile would have its own identity/endpoint independent of the author URLs.
- Is there a filter or hook I could use so the blog actor’s “self” URL (and WebFinger) points to its proper ActivityPub actor endpoint (e.g. /wp-json/activitypub/1.0/…) instead of /?author=0, so it doesn’t depend on the blocked route?
If there’s a supported way to do this from the plugin side, that would solve it without touching the host’s security. Thanks so much for looking into it!