amethyst icon indicating copy to clipboard operation
amethyst copied to clipboard

[BUG] NIP05 verification follows redirects against specification

Open davotoula opened this issue 8 months ago • 4 comments

Describe the bug Currently nip05 verification will follow a redirect for nip05 verification.

From the spec NIP05 specification:

Security Constraints The /.well-known/nostr.json endpoint MUST NOT return any HTTP redirects.

Fetchers MUST ignore any HTTP redirects given by the /.well-known/nostr.json endpoint.

Expected behaviour NIP05 verification should fail if it encounters a 3xx redirect

Note HTTP to HTTPS redirect should be considered to be allowed but looking at the code HTTPS is used by default. FollowRedirects OFF will likely turn off protocol redirects as well

davotoula avatar Jun 14 '24 13:06 davotoula