mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-08 21:45:52 +00:00
Code Packages Wiki Activity

FEP-fc48: Review side effects and authorization requirements (#851)

Browse Source 
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/851
This commit is contained in:
silverpill
2026-05-27 14:43:43 +02:00
committed by silverpill
parent 39a8ca9a37
commit 3b1af4ec5e
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/fc48/fep-fc48.md
+8 -6
View File
@@ -25,10 +25,6 @@ A truly generic server does not have these limitations and can work with any typ
A generic server MUST determine the class of an object before processing it. The classification of ActivityPub objects is covered in [FEP-2277: ActivityPub core types][FEP-2277].
## Authentication and authorization
A generic server MUST verify all objects according to the universal authentication and authorization procedures described in [FEP-fe34: Origin-based security model][FEP-fe34].
## Activities and side effects
A generic server MUST support the following basic activities:
@@ -41,9 +37,15 @@ A generic server MUST support the following basic activities:
The side effects of these activities are implicit and are defined in the [ActivityPub] specification.
A generic server SHOULD support other activity types defined in the [ActivityPub] specification.
A generic server can only carry out the side effects of basic activities. Therefore, clients MUST specify the side effects of all other activities as additional activities. Clients can embed them into an activity using the `result` property, or send them separately.
Other activities MUST NOT have implicit side-effects. Any side-effects, such as collection updates, MUST be specified by clients as additional activities. Clients can embed them into an activity using the `result` property, or send them as separate activities.
A generic server MAY support other activity types defined in the [ActivityPub] specification.
## Authentication and authorization
A generic server MUST verify all objects according to the universal authentication and authorization procedures described in [FEP-fe34: Origin-based security model][FEP-fe34].
When processing activities submitted by a client, the server can only check permissions for basic activities. Therefore, recipients SHOULD NOT use the same-origin policy to verify permissions.
## Managing collections