Comment on So I kind of set up another level of security well not really more of a gate to

webfan@inne.city ⁨2⁩ ⁨weeks⁩ ago

• pasjrwoctx@social.2ndshot.photos ⁨2⁩ ⁨weeks⁩ ago

  @webfan the only reason to exclude the /inbox route is if you are finding a lot of bots and scrapers accessing your inbox before they scrape your profile, in theory friendicas rules and activitypubs rules should already have your inbox blocked from that activity, I created this because even with a very robust .htaccess file I was getting a lot of bots and scrapers accessing "GET" and "Profile" in my access logs, most where defeating my robots.txt and breaking the rules in .htaccess, this at the moment has killed them, first 2 days they all got 403's and then they just stopped trolling my instance at all; I think it could be customized to your individual needs, I made it shareable, I wont maintain it, it works for me and if by chance it helps anyone well all the better, by all means adapt and modify it to your instance's needs and if it works share it with the community, security and privacy in numbers I say;

  original

  • webfan@inne.city ⁨2⁩ ⁨weeks⁩ ago

    @pasjrwoctx Sorry, I mean the /inbox route from the check

    $is_fediverse =
    str_contains($request, '/.well-known/') ||
    str_contains($request, '/activitypub/') ||
    str_contains($request, '/api/') ||
    str_contains($request, '/assets/') ||
    str_contains($request, '/inbox');

    You could also check for Request-Type headers.

    A cookie can be faked, you should consider to store the OK in the session instead?

    original

    • pasjrwoctx@social.2ndshot.photos ⁨2⁩ ⁨weeks⁩ ago

      @webfan also if you wanted to go that far as adding /inbox following the logic you should probably also add /nodeinfo as well;

      original

      • webfan@inne.city ⁨2⁩ ⁨weeks⁩ ago

        @pasjrwoctx You are right, sorry I did not read the complete code, I was in $is_fediverse =... line.
        if ($request === '/' makes it clear, sorry!
        $is_fediverse and is_static is not necessary then?

        original
    • pasjrwoctx@social.2ndshot.photos ⁨2⁩ ⁨weeks⁩ ago

      @webfan cookie could be faked but so can headers, and the way I have it now the cookie is only good for the session, bots and scrapers start a new session every time they probe a domain so no need to store, each time they troll its a new session, putting inbox in the check I guess could be useful to gate it, but when I sat down to do this and dug through all my access logs I did not have even one call for the inbox to be worried about it, now if I get bots or scrapers that start calling for my inbox I will gate it, but my understanding of how friendica and activitypub are setup the inbox should not be callable by bots and scrapers, I maybe wrong on that, I have had this instance up an running a year, and it has be en a lot of learning and trial and error so many errors, but so far this gate has really made my access logs go empty, which for me is good, im still fully federated but the datahogs have slowed or stopped trolling me

      original