Improvement: include query string in the HTTP signature (#480)

shleeable · Your Name · web-flow · commit 1e2edeac88aa · 2026-02-06T22:36:49.000-07:00
* fix

* pint

* updated

* updated

---------

Co-authored-by: Your Name &lt;you@example.com&gt;
diff --git a/app/Jobs/Federation/DeliverCommentLikeActivity.php b/app/Jobs/Federation/DeliverCommentLikeActivity.php
@@ -90,6 +90,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -98,7 +101,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverCommentReplyLikeActivity.php b/app/Jobs/Federation/DeliverCommentReplyLikeActivity.php
@@ -90,6 +90,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -98,7 +101,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverCreateCommentActivity.php b/app/Jobs/Federation/DeliverCreateCommentActivity.php
@@ -93,6 +93,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -101,7 +104,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverCreateCommentReplyActivity.php b/app/Jobs/Federation/DeliverCreateCommentReplyActivity.php
@@ -93,6 +93,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -101,7 +104,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverCreateVideoActivity.php b/app/Jobs/Federation/DeliverCreateVideoActivity.php
@@ -97,6 +97,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -105,7 +108,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverDeleteCommentActivity.php b/app/Jobs/Federation/DeliverDeleteCommentActivity.php
@@ -95,6 +95,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -103,7 +106,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverDeleteCommentReplyActivity.php b/app/Jobs/Federation/DeliverDeleteCommentReplyActivity.php
@@ -95,6 +95,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -103,7 +106,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverDeleteVideoActivity.php b/app/Jobs/Federation/DeliverDeleteVideoActivity.php
@@ -95,6 +95,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -103,7 +106,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverFollowRequest.php b/app/Jobs/Federation/DeliverFollowRequest.php
@@ -71,6 +71,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -79,7 +82,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverRejectActivity.php b/app/Jobs/Federation/DeliverRejectActivity.php
@@ -66,6 +66,9 @@ public function handle(): void
         }
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         $headers = [
             'Host' => $parsedUrl['host'],
@@ -82,7 +85,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverUndoCommentLikeActivity.php b/app/Jobs/Federation/DeliverUndoCommentLikeActivity.php
@@ -88,6 +88,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -96,7 +99,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverUndoCommentReplyLikeActivity.php b/app/Jobs/Federation/DeliverUndoCommentReplyLikeActivity.php
@@ -88,6 +88,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -96,7 +99,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverUndoFollowActivity.php b/app/Jobs/Federation/DeliverUndoFollowActivity.php
@@ -83,6 +83,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -91,7 +94,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverUndoFollowRequestActivity.php b/app/Jobs/Federation/DeliverUndoFollowRequestActivity.php
@@ -71,6 +71,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -79,7 +82,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverUndoVideoLikeActivity.php b/app/Jobs/Federation/DeliverUndoVideoLikeActivity.php
@@ -92,6 +92,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -100,7 +103,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Jobs/Federation/DeliverUpdateVideoActivity.php b/app/Jobs/Federation/DeliverUpdateVideoActivity.php
@@ -93,6 +93,9 @@ public function handle(): void
         ];
 
         $signatureService = app(HttpSignatureService::class);
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
@@ -101,7 +104,7 @@ public function handle(): void
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 json_encode($activity)
             );
 
diff --git a/app/Services/DeliveryService.php b/app/Services/DeliveryService.php
@@ -40,12 +40,16 @@ public function deliverToInbox($actor, $target, $activity)
 
         try {
             $privateKey = app(SigningService::class)->getPrivateKey();
+            $path = $parsedUrl['path'] ?? '/';
+            $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+            $requestPath = $path.$queryString;
+
             $signature = $this->signatureService->sign(
                 $actor->getKeyId(),
                 $privateKey,
                 $headers,
                 'POST',
-                $parsedUrl['path'] ?? '/',
+                $requestPath,
                 $body
             );
 
diff --git a/app/Services/RelayService.php b/app/Services/RelayService.php
@@ -195,12 +195,16 @@ protected function deliverActivity(Profile $actor, string $inboxUrl, array $acti
         ];
 
         $privateKey = $this->signingService->getPrivateKey();
+        $path = $parsedUrl['path'] ?? '/';
+        $queryString = isset($parsedUrl['query']) ? '?'.$parsedUrl['query'] : '';
+        $requestPath = $path.$queryString;
+
         $signature = app(HttpSignatureService::class)->sign(
             $actor->getKeyId(),
             $privateKey,
             $headers,
             'POST',
-            $parsedUrl['path'] ?? '/',
+            $requestPath,
             $body
         );
 
