Hello - this is posted by a Pixelfed account

Abanink (Pixelfed)

Sun, 05 Mar 2023 20:49:20 +0100 from pixelfed

Posted after being logged in through remote auth (OpenWebAuth) using account abanink@sandpix.eenoog.org

show all 7 comments

Pascal (Friendica)

Fri, 05 May 2023 09:53:01 +0200 from friendica

And also commented on from a Friendica account BUT

only possible on Streams for the moment, not on Hubzilla (magic auth / webfinger not working, something with the "acct:" layout that Friendica is using, I expect to able to backport a solution from Streams)
I suspect that Friendica has a bug in the HTTP Signing & request sending routine (*) which could potentially break all other parties that they use the magic authentication for - however, I wonder how they can use it currently if all verification of the signature should fail). When I fix it and use the same headers for signing & sending, verification works and remote auth works as well.

(*) some details: the routine is signing with the header accept = ['application/x-dfrn+json', 'application/x-zot+json'] but then sending on the wire with accept = (all). So verification fails and the remote auth is denied correctly - and any other system doing this should as well.
I trace that back to this commit on Friendica (dating from Apr 2022).
I'll create a bug report on Friendica for this.

Pascal (Streams)

Mon, 08 May 2023 09:34:59 +0200 from YunoHost Streams

Change to fix Hubzilla is proposed as MR here: https://framagit.org/hubzilla/core/-/merge_requests/2036

Pascal (Streams)

Wed, 26 Jul 2023 22:20:19 +0200 from YunoHost Streams

Friendica has fixed a limitation wrt logging in through OpenWebAuth on Hubzilla

see this Friendica issue

Ema エマ

Wed, 26 Jul 2023 23:46:20 +0200 from hubzilla

🎉
thank you!