@julian Hmm, I think I must be failing your 9421 request. I think I will have to add logging back.

@mradcliffe@nokoto.org if your software is open, I (or rather, my local AI ) can do a deep dive.

@silverpill@mitra.social my laptop says the timeout is due to Mitra's 10s timeout (this may be incorrect), and to try again activitypub.space is slow, it's hit by many scrapers and a 10+s response is not out of the ordinary.

@julian

It works now, this time the response was quick (200 OK)

@silverpill @julian It’s working for me too. I did not realize more implementations were not going to include alg parameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assume rsa-v1_5-sha256 if it’s missing. I know that’s not great, but maybe we should all just agree to include alg?

I guess @Edent feels the same way.

@mradcliffe @julian @Edent Agreed - my implementation adds the alg parameter.

But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.

https://portswigger.net/web-security/jwt/algorithm-confusion

Thanks both!

I'll look into adding the alg parameter and circle back.

@julian Thank you. Unfortunately, it's not open... Yet. I am working on trying to split out what makes nokoto.org unique.

I know that I get RFC9421 successes from Gush at least. :-)

@mradcliffe @julian

If you send some messages to @example I can see if I'm able to validate their signatures.
It works with the ones Mastodon sends.

@Edent just tried to DM it from Loops and it doesn't recognize the account