Post #3082813
2026-05-20 23:28 UTC
@julian You're making a very strong assumption that the remote server is necessarily checking for things it might not actually be checking for.
Neither the "instance" model nor the "same origin" model are enshrined in ActivityPub. This technically falls under "undefined behavior", because AP doesn't define an authorization model. (It suggests ("may") same origin, but that's about it. A lot of things are "at the receiving server's discretion".)
Replies (1)
-
@julian@activitypub.space 2026-05-20 23:49
@trwnh@mastodon.social on the flip side, I could argue that if the sending server doesn't enforce boundaries between actors, then there's no need to enforce the boundary on my end. For example, if the sending server is a federated wiki where anyone™️ can edit, then it would actually be incorrect for me to enforce a boundary.