ThibG 28b482874a Improvements to signature verification (#9667) ...

* Refactor signature verification a bit

* Rescue signature verification if recorded public key is invalid

Fixes #8822

* Always re-fetch AP signing key when HTTP Signature verification fails

But when the account is not marked as stale, avoid fetching collections and
media, and avoid webfinger round-trip.

* Apply stoplight to key/account update as well as initial key retrieval

2019-01-07 21:45:13 +01:00

4.8 KiB

Raw Blame History

View Raw