Implementing your own Fedi server is shit, don't do it, I can't believe I ruined the last 4 days of my life with this

@mooooooo@qaf.men sort of! Mastodon does it that way, where if you request the keyId as identified in the HTTP signature, it returns the entire user object.

That's what we call a "Mastodon-ism". It's not strictly right, but it is what it is. AP implementations should properly handle it if you return just the publicKey portion alone.

For example, @evan's tags.pub does this correctly. @test@tags.pub will return the full actor object, but if you query the publicKeyPem, you get this: https://tags.pub/user/test/publickey

@julian @mooooooo

> a "Mastodon-ism". It's not strictly right

actually it's not wrong, especially when/because the key is a fragment of the returned document.

you're supposed to get the document and then *find the graph node that matches the input id*.

i suspect some implementations don't recognize that they need to do this, and they just assume that the key is *always* at $.publicKey.publicKeyPem or at $.publicKeyPem. that's incorrect.

@trwnh @julian @mooooooo it's also crappy for caching. Using a standalone document for the key lets you set a far-future expiry header, `Cache-Control: max-age=315360000`. So, clients never need to refetch. If you want to rotate the key, you give a new ID with a new URL.

@mooooooo@qaf.men You can try checking my code:
https://github.com/nekromoff/mastodon-bots

@dusoft Thank you