Post #4170041

2026-07-28 15:39 UTC

Can WebFinger resolve subject to a different domain? My immediate assumption is yes, it can, because someone may use a specific domain merely as a gateway, and point to a different domain for resolution. e.g. https://activitypub.directory/.well-known/webfinger?resource=acct:julian@activitypub.space (note the different TLD) Resolving to: {"subject":"acct:julian@activitypub.space","aliases":["https://activitypub.space/uid/1","https://activitypub.space/user/julian"],"links": ... However, this is a potential security issue because said directory could then poison the resulting data, especially if cached by a user of that webfinger directory. Am I wrong about that? In the meantime I've updated NodeBB's code to strictly enforce webfinger lookups so if a response subject has a different hostname, then the webfinger query result is considered invalid.[...]

Replies (4)

@evan@cosocial.ca 2026-07-28 17:54

@julian so, here's what RFC 7033 says: "The host to which a WebFinger query is issued is significant. If the query target contains a "host" portion (Section 3.2.2 of RFC 3986), then the host to which the WebFinger query is issued SHOULD be the same as the "host" portion of the query target, unless the client receives instructions through some out-of-band mechanism to send the query to another host. [...]"

Open ##4170039
@benpate@mastodon.social 2026-07-28 18:03

@julian I believe there was a questionably named “WebFist” protocol that allowed cross-server WebFinger. https://indieweb.org/Webfist

Open ##4170224
@trwnh@mastodon.social 2026-07-29 07:38

@julian You're not wrong -- it's just generally not considered "authoritative". Compare to DNS via the authoritative nameserver, versus DNS via a public resolver. dns:trwnh.com is different than dns://8.8.8.8/trwnh.com in that the latter is explicitly resolved via Google, or dns://1.1.1.1/trwnh.com to resolve via Cloudflare.

Open ##4187687
@wronglang@bayes.club 2026-07-28 17:08

@julian just out of curiosity is it related to this funny looking thing? https://wrong.webfinger-canary.fietkau.software/canary

Open ##4193994