I’ve implemented this: my ticket_endpoint will accept a (currently optional) iss parameter. If that’s included, the endpoint will check that the issuer URL advertises indieauth-metadata endpoint and is valid as described in the spec.

I think I like this solution to the privacy concern. It also avoids the overhead of advertising endpoints on multiple resource URLs. So I lean towards requiring the iss when sending a ticket. However, I’m not sure how many implementations might send an issuer URL that does not advertise the metadata endpoint.

I now have the building blocks for Ticketing for IndieAuth set up.

On my staging site, the metadata endpoint now advertises the ticket_endpoint. That endpoint is accepting POST requests with parameters: ticket, resource, and subject. If the request is valid, it will be stored and return HTTP 202 with the message “Accepted.” Tickets are not automatically redeemed yet.

In the IndieAuth module admin, I set up a page to issue a ticket by entering a URL for “Allow access to” (the resource) and “Send ticket to” (the subject). Submitting that form will check the subject URL for an indieauth-metadata endpoint that advertises a ticket_endpoint. If that is found successfully, a ticket is created and sent there.

Finally, I updated the token_endpoint to accept POST requests with grant_type=ticket and exchange the ticket for an access token.

Next I will be working on automatically redeeming received tickets for access tokens and setting up some private posts to work with granted access tokens.

I am currently using the same code that generates authorization codes to make the tickets. I think this should work fine because it already handles creating an opaque string that is valid for a short period of time (5 minutes). The module also ensures these can only be used once and logs key information for each request like client_id (source code). I need to run some tests to ensure tickets can’t be used as authorization codes and I might need to add some metadata to differentiate the two in the admin area.

Feel free to try to send a ticket to my staging site and ping me in IndieWeb dev chat. I can also send you a ticket if you’d like to try that out. I look forward to discussing this with other implementers!

Remember The Well? Pioneering on-line community, still around after almost 40 years.

This week and next, it will host an on-line discussion on the #Fediverse and #indieweb.

Glad to be part of it, together with @evan, @manton, @KevinMarks and @herestomwiththeweather. It's hosted by Jon Lebowsky, best known (to me at least) by doing the annual State of the World panel, also on the Well, with @bruces.

I'll post a link once the thread is public. With these panelists, it should be interesting!!

Belonging and community

IndieWebCamp Nuremberg

I wrote some thoughts about community and belonging as part of this month's #indieweb carnival. https://werd.io/2023/belonging-and-community

Today's adventures in self-hosting involve me getting way more familiar with how exactly #BookWyrm works!

Super grateful to @tripofmice for all of their work on this awesome project, and for being such a wonderfully welcoming maintainer, and cultivating a friendly and supportive contributor community 👏🏻

If you're a BookWyrm user or otherwise invested in seeing ActivityPub continue to grow and thrive, you can support BookWyrm development here: https://www.patreon.com/bookwyrm

#IndieWeb #ActivityPub

I've been using the indieConnector plugin by mauricerenck with #Kirby.


#POSSE #IndieWeb

Issue 2 of #OwnYourWeb is out. 🥳

This time, we’re looking at one of the first things every website needs: a domain name.

Plus links to posts by @michelle, @jimniels, @davidpierce, Manuel Moreale (https://manuelmoreale.com), and more.

Personal site of the (every other) week by @mxbck 🎨✨

https://buttondown.email/ownyourweb/archive/issue-02/

#newsletter #web #IndieWeb

#webrings watch No. 31

the VOCALOID #webring
https://webring.adilene.net/

With over 100 members this special clique is back, and better than ever, in V2! From the software to the performers to the songs, if you share any of the enthusiasm: Sign up today!

#japan #anime #music #pop #indieweb #smallweb #web #webdev #html #programming #retro #tech #synth

Bookmarked [Discover the IndieWeb, one blog post at a time](https://indieblog.page/all).

↬ [Chuck Grimmett](https://cagrimmett.com/likes/16e3de6cf8/)

#indieweb #WebFeeds

(https://bddz.be/GZN)

Jumping in todays posting trend, app defaults

https://flamedfury.com/posts/app-defaults/

#blog #blogging #indieweb

Recently read an article about #posse and got fascinated around the #indieweb movement. Claiming your data is important. But if you can't, why not link back to a source that you actually own?

Any #IndieWeb folk heading to #ffconf next week? I’m wondering if anyone fancies a little informal Homebrew Website Club, or maybe just a coffee or a pint.

If there is a #indieweb full of cats then we need to have also a #indieweb of dogs

@pax I see.

Well, that is up to each admin. As long as they know how to differentiate between #Bridgy as #IndieWeb and the Bridgy bridge for the #ATprotocol. If they block the IndieWeb Bridgy that's going to be the most misinformed thing they'll ever do.

As for "normal fedi server", I thing that's very subjective. When is one "evil"? What constitute "racist"? And define "garbage".

Does an instance from Africa by and for Africans racist because they normally use #negro? Am I racist if you see me talk about #KKK? What if an instance is trying to be as neutral as possible? And as moderators are mostly not paid thus there are few moderators in each instance, does it make an instance "not normal" just because they can't monitor every single post and take action against every report immediately?

A few days ago I talked about how Ferdinand Magellan was, is, and never will be a hero contrary to the claims of Spaniards and his white supporters, am I racist then? But they are not despite his many victims and how he looked down on people especially those who are not white?

That's like saying I am not #autistic because I don't look from the upper-right corner of my eyes, or doesn't flap my arms, so I must be "normal"?

😃