amethyst
amethyst copied to clipboard
[BUG] NIP05 verification follows redirects against specification
Describe the bug Currently nip05 verification will follow a redirect for nip05 verification.
From the spec NIP05 specification:
Security Constraints The /.well-known/nostr.json endpoint MUST NOT return any HTTP redirects.
Fetchers MUST ignore any HTTP redirects given by the /.well-known/nostr.json endpoint.
Expected behaviour NIP05 verification should fail if it encounters a 3xx redirect
Note HTTP to HTTPS redirect should be considered to be allowed but looking at the code HTTPS is used by default. FollowRedirects OFF will likely turn off protocol redirects as well