Question re: Origin Based Security Model (FEP-fe34)
2026-05-20 20:36 UTC
@silverpill@mitra.social said:
In some cases, FEP-fe34 recommends same-actor policy as an additional protection against implementation bugs and against implementations that don't enforce actor boundaries on purpose. Update/Delete authorization is one of those cases (admittedly, the wording is a bit confusing in that paragraph...)
Does this mean NodeBB is wrong is allowing different actors on the same origin to publish Updates and Deletes? I do not know of a way to reconcile this with the ability to have moderators carry out their actions.
Replies (1)
-
@silverpill@mitra.social 2026-05-20 21:18
No, it's not wrong. I think the good of group moderation currently outweighs the theoretical bad of same-origin impersonation.