// ---------------------------------------------------------------------------
async function checkHttpSignature (req: Request, res: Response) {
- // FIXME: mastodon does not include the Signature scheme
+ // FIXME: compatibility with http-signature < v1.3
const sig = req.headers[HTTP_SIGNATURE.HEADER_NAME] as string
- if (sig && sig.startsWith('Signature ') === false) req.headers[HTTP_SIGNATURE.HEADER_NAME] = 'Signature ' + sig
+ if (sig && sig.startsWith('Signature ') === true) req.headers[HTTP_SIGNATURE.HEADER_NAME] = sig.replace(/^Signature /, '')
- const parsed = parseHTTPSignature(req)
+ const parsed = parseHTTPSignature(req, HTTP_SIGNATURE.CLOCK_SKEW_SECONDS)
const keyId = parsed.keyId
if (!keyId) {