From 9e4076489a3878ab913d52d4932f2f15c86e469e Mon Sep 17 00:00:00 2001 From: Mike P Date: Sun, 16 Feb 2025 13:41:35 +0000 Subject: [PATCH] FEP-61cf: Add sequence diagram (#498) Add a basic sequence diagram using Mermaid syntax: https://mermaid.js.org/syntax/sequenceDiagram.html Co-authored-by: FenTiger Reviewed-on: https://codeberg.org/fediverse/fep/pulls/498 Co-authored-by: Mike P Co-committed-by: Mike P --- fep/61cf/fep-61cf.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/fep/61cf/fep-61cf.md b/fep/61cf/fep-61cf.md index 244b465..11965d6 100644 --- a/fep/61cf/fep-61cf.md +++ b/fep/61cf/fep-61cf.md @@ -36,6 +36,32 @@ This `zid=` mechanism is not necessarily specific to OpenWebAuth. It can be used ## Operation of the protocol +The protocol can be summarised in a sequence diagram as below. This diagram shows the `zid=` case, where the user is not prompted to log in. + +```mermaid +sequenceDiagram + participant browser as Browser + participant target as Target instance + participant home as Home instance + + browser ->> target: GET /page?zid=user@home + target ->> home: webfinger user@home + home -->> target: location of redirection endpoint + target -->> browser: Location: https://home.example/magic?... + browser ->> home: GET /magic?... + Note over home: Check user is logged in,
eg by checking session cookie + home ->> target: webfinger / + target -->> home: location of token endpoint + rect rgb(216, 255, 216) + Note over home,target: Protected by actor's private key + home ->> target: GET /token
(signed) + target -->> home:
(encrypted) + end + home -->> browser: Location: https://target.example/page?owt= + browser ->> target: GET /page?owt= + target -->> browser: +``` + Regardless of how the flow is started, the protocol begins with the user's browser making a request to the target instance. ### 1. Redirection to home instance