From 797d05bdd99b63104522051d0f61f1e0f003e780 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Thu, 12 Nov 2020 10:42:25 +0100 Subject: Force signed headers in http signatures Thanks Roger --- server/helpers/peertube-crypto.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'server/helpers') diff --git a/server/helpers/peertube-crypto.ts b/server/helpers/peertube-crypto.ts index 1655cd7b5..994f725d8 100644 --- a/server/helpers/peertube-crypto.ts +++ b/server/helpers/peertube-crypto.ts @@ -50,7 +50,11 @@ function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): bool } function parseHTTPSignature (req: Request, clockSkew?: number) { - return httpSignature.parse(req, { clockSkew }) + const headers = req.method === 'POST' + ? HTTP_SIGNATURE.REQUIRED_HEADERS.POST + : HTTP_SIGNATURE.REQUIRED_HEADERS.ALL + + return httpSignature.parse(req, { clockSkew, headers }) } // JSONLD -- cgit v1.2.3