Skip to main content

DEFAULT_HEADER_SET

actpub_httpsig

Constant DEFAULT_HEADER_SET 

Source 
pub const DEFAULT_HEADER_SET: &[&str];
Expand description

The default header set signed on outbound POST requests.

Contains the five headers every mainstream Fediverse implementation (Mastodon, Pleroma, Lemmy, Mitra, Misskey) expects to see participate in the signature base:

  • (request-target) – method + path + query pseudo-header
  • host – domain the request is being sent to
  • date – HTTP-date used for replay-window enforcement
  • digest – legacy body digest (RFC 3230 / 5843)
  • content-type – defence against content-type confusion attacks; Mitra and strict Lemmy versions require it and Mastodon simply ignores additional signed headers

Callers typically construct a CavageSigner without specifying the header set, in which case this default applies.