Deploying from 3050a7b82e [SKIP CI]

fep/fe34/index.html

@@ -766,7 +766,7 @@
 <p>The origin-based security model is designed for use in a network where a server is responsible for enforcing security boundaries between the hosted actors. This assumption is based on the general consensus that served objects can be trusted and that their ownership doesn't require verification. Servers that publish objects without validation are not supported.</p>
 <p>Object identifiers are assumed to be HTTP(S) URIs. The model can also be used with other kinds of identifiers, but that is not covered in this document.</p>
 <h2 id="origin">Origin<a class="headerlink" href="#origin" title="Permanent link">&para;</a></h2>
-<p>Object identifiers can be grouped together into protection domains called "origins". This concept is similar to the "web origin" concept described in <a href="https://www.rfc-editor.org/rfc/rfc6454.html">RFC-6454</a>, and origins of object IDs are computed by the same algorithm.</p>
+<p>Object identifiers are grouped together into protection domains called "origins". This concept is similar to the "web origin" concept described in <a href="https://www.rfc-editor.org/rfc/rfc6454.html">RFC-6454</a>, and origins of object IDs are computed by the same algorithm.</p>
 <p>The same-origin policy determines when a relationship between objects can be trusted. Different origins are considered potentially hostile and are isolated from each other to varying degrees. Actors sharing an origin are assumed to trust each other because the server enforces boundaries between them.</p>
 <h3 id="comparing-origins">Comparing origins<a class="headerlink" href="#comparing-origins" title="Permanent link">&para;</a></h3>
 <ol>
@@ -808,13 +808,14 @@
 <p>JSON-LD consumers might be tricked into processing a specially crafted JSON object without <code>publicKeyPem</code> and <code>publicKeyMultibase</code> properties as a public key. Protections against attacks of that kind are not described in this document.</p>
 </div>
 <h3 id="embedding">Embedding<a class="headerlink" href="#embedding" title="Permanent link">&para;</a></h3>
-<p>In some cases, an embedded object can be trusted when its wrapping object is trusted:</p>
+<p>An embedded object can be trusted if the following conditions are met:</p>
 <ul>
-<li>An embedded object has the same origin and the same <a href="#ownership">owner</a> as the wrapping object.</li>
-<li>An embedded object is identified as a <a href="https://en.wikipedia.org/wiki/URI_fragment">fragment</a> of the wrapping object.</li>
-<li>An embedded object is anonymous (doesn't have an ID).</li>
+<li>Its wrapping object is trusted.</li>
+<li>The embedded object is anonymous (doesn't have an ID), or has the same origin as the wrapping object.</li>
+<li>The embedded object is anonymous, or has the same <a href="#ownership">owner</a> as the wrapping object.</li>
 </ul>
-<p>Servers MUST NOT allow clients to publish activities where embedded objects are owned by another local actor.</p>
+<p>Consumers MUST NOT trust embedded objects that do not satisfy these conditions.</p>
+<p>In order to mitigate impersonation risks resulting from consumers not verifying ownership during the authentication, originating servers MUST enforce actor isolation by recursively verifying those objects when a client submits an activity. If an embedded object is owned by a different local actor, the server must either authenticate the object or reject the activity.</p>
 <p>Embedded non-anonymous objects SHOULD NOT be partial representations. A server that relies on embedding for authentication might save a partial representation of an object to the cache, replacing the full object.</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
@@ -836,7 +837,7 @@
 <li>A <code>replies</code> collection is owned by the actor to which the post is attributed.</li>
 <li>All pages of a collection are expected to be owned by the same actor.</li>
 </ul>
-<p>Anonymous objects are not supposed to have an owner.</p>
+<p>An anonymous object has the same owner as its wrapping object.</p>
 <p>Applications can use the following algorithm to determine the owner of an object:</p>
 <ol>
 <li>Run the duck typing algorithm specified in <a href="https://codeberg.org/fediverse/fep/src/branch/main/fep/2277/fep-2277.md">FEP-2277</a>.</li>