Re:Mastodon Instance with 6 Files
by Steltek on Tuesday December 06, 2022 @02:42PM
(#33885877)
Which RFC says query parameters is a good idea? The .well-known RFC (5785) itself states:
> well-known URIs are not intended for general information retrieval or establishment of large URI namespaces on the Web.
The WebFinger RFC appears to stuff its entire protocol into .well-known! And it includes some fine examples such as:
GET /.well-known/webfinger?
resource=acct%3Abob%40example.com&
rel=http%3A%2F%2Fwebfinger.example%2Frel%2Fprofile-page&
rel=http%3A%2F%2Fwebfinger.example%2Frel%2Fbusinesscard HTTP/1.1
Host: example.com
I would say that .well-known should be kept simple for both security and correctness. Dynamic content can be exploited more easily, as directly evidenced by you bringing CGI into the discussion. Additionally, .well-known is a global namespace and should not be a broad query interface when those queries can be reasonably furnished by other means.
My experience with .well-known is that it's more or less an application level DNS and identity service. But this looks like those hacks where you can read Wikipedia using `dig`.
> well-known URIs are not intended for general information retrieval or establishment of large URI namespaces on the Web.
The WebFinger RFC appears to stuff its entire protocol into .well-known! And it includes some fine examples such as:
I would say that .well-known should be kept simple for both security and correctness. Dynamic content can be exploited more easily, as directly evidenced by you bringing CGI into the discussion. Additionally, .well-known is a global namespace and should not be a broad query interface when those queries can be reasonably furnished by other means.My experience with .well-known is that it's more or less an application level DNS and identity service. But this looks like those hacks where you can read Wikipedia using `dig`.