@blog

Activities are supposed to be idempotent, but there is a possibility of replaying delivery to a different inbox. The server may add the receiving actor to the private audience of an activity, thus making activity visible beyond its intended audience. By "private audience" I mean bto / bcc - an anti-feature, in my opinion, but unfortunately some applications rely on it.

This is why we also sign the request target.

Signing/verifying request target is more important when working with GET requests. If a server doesn't verify request targets, an attacker can gain access to unrelated private resources by changing the target and replaying the request.

Even if request target is verified, an attacker can still gain access to the intended target resource - and this is where timestamp becomes useful. A short expiration time makes it harder to replay the request.

I recently added related recommendations to the ActivityPub developer guide:

https://codeberg.org/ap-next/ap-next/src/branch/main/guide.md#http-signatures