I now have the building blocks for Ticketing for IndieAuth set up.

On my staging site, the metadata endpoint now advertises the ticket_endpoint. That endpoint is accepting POST requests with parameters: ticket, resource, and subject. If the request is valid, it will be stored and return HTTP 202 with the message “Accepted.” Tickets are not automatically redeemed yet.

In the IndieAuth module admin, I set up a page to issue a ticket by entering a URL for “Allow access to” (the resource) and “Send ticket to” (the subject). Submitting that form will check the subject URL for an indieauth-metadata endpoint that advertises a ticket_endpoint. If that is found successfully, a ticket is created and sent there.

Finally, I updated the token_endpoint to accept POST requests with grant_type=ticket and exchange the ticket for an access token.

Next I will be working on automatically redeeming received tickets for access tokens and setting up some private posts to work with granted access tokens.

I am currently using the same code that generates authorization codes to make the tickets. I think this should work fine because it already handles creating an opaque string that is valid for a short period of time (5 minutes). The module also ensures these can only be used once and logs key information for each request like client_id (source code). I need to run some tests to ensure tickets can’t be used as authorization codes and I might need to add some metadata to differentiate the two in the admin area.

Feel free to try to send a ticket to my staging site and ping me in IndieWeb dev chat. I can also send you a ticket if you’d like to try that out. I look forward to discussing this with other implementers!

@mariyadelano I think people are trying to solve that problem now, and one of them is to embrace #IndieWeb principles, fall back on email lists and federated social media. It's all going to be slower in terms of growth, but I think the connections we build this way will be more quiet and intimate.
I think a whole ecosystem is currently being built under the big, corporate surface that is Google search engines. One that is not as easily controlled or found.

I’ve implemented this: my ticket_endpoint will accept a (currently optional) iss parameter. If that’s included, the endpoint will check that the issuer URL advertises indieauth-metadata endpoint and is valid as described in the spec.

I think I like this solution to the privacy concern. It also avoids the overhead of advertising endpoints on multiple resource URLs. So I lean towards requiring the iss when sending a ticket. However, I’m not sure how many implementations might send an issuer URL that does not advertise the metadata endpoint.

I now have the building blocks for Ticketing for IndieAuth set up.

On my staging site, the metadata endpoint now advertises the ticket_endpoint. That endpoint is accepting POST requests with parameters: ticket, resource, and subject. If the request is valid, it will be stored and return HTTP 202 with the message “Accepted.” Tickets are not automatically redeemed yet.

In the IndieAuth module admin, I set up a page to issue a ticket by entering a URL for “Allow access to” (the resource) and “Send ticket to” (the subject). Submitting that form will check the subject URL for an indieauth-metadata endpoint that advertises a ticket_endpoint. If that is found successfully, a ticket is created and sent there.

Finally, I updated the token_endpoint to accept POST requests with grant_type=ticket and exchange the ticket for an access token.

Next I will be working on automatically redeeming received tickets for access tokens and setting up some private posts to work with granted access tokens.

I am currently using the same code that generates authorization codes to make the tickets. I think this should work fine because it already handles creating an opaque string that is valid for a short period of time (5 minutes). The module also ensures these can only be used once and logs key information for each request like client_id (source code). I need to run some tests to ensure tickets can’t be used as authorization codes and I might need to add some metadata to differentiate the two in the admin area.

Feel free to try to send a ticket to my staging site and ping me in IndieWeb dev chat. I can also send you a ticket if you’d like to try that out. I look forward to discussing this with other implementers!

Remember The Well? Pioneering on-line community, still around after almost 40 years.

This week and next, it will host an on-line discussion on the #Fediverse and #indieweb.

Glad to be part of it, together with @evan, @manton, @KevinMarks and @herestomwiththeweather. It's hosted by Jon Lebowsky, best known (to me at least) by doing the annual State of the World panel, also on the Well, with @bruces.

I'll post a link once the thread is public. With these panelists, it should be interesting!!

Belonging and community

IndieWebCamp Nuremberg

I wrote some thoughts about community and belonging as part of this month's #indieweb carnival. https://werd.io/2023/belonging-and-community

Today's adventures in self-hosting involve me getting way more familiar with how exactly #BookWyrm works!

Super grateful to @tripofmice for all of their work on this awesome project, and for being such a wonderfully welcoming maintainer, and cultivating a friendly and supportive contributor community 👏🏻

If you're a BookWyrm user or otherwise invested in seeing ActivityPub continue to grow and thrive, you can support BookWyrm development here: https://www.patreon.com/bookwyrm

#IndieWeb #ActivityPub

I've been using the indieConnector plugin by mauricerenck with #Kirby.


#POSSE #IndieWeb

Issue 2 of #OwnYourWeb is out. 🥳

This time, we’re looking at one of the first things every website needs: a domain name.

Plus links to posts by @michelle, @jimniels, @davidpierce, Manuel Moreale (https://manuelmoreale.com), and more.

Personal site of the (every other) week by @mxbck 🎨✨

https://buttondown.email/ownyourweb/archive/issue-02/

#newsletter #web #IndieWeb

#webrings watch No. 31

the VOCALOID #webring
https://webring.adilene.net/

With over 100 members this special clique is back, and better than ever, in V2! From the software to the performers to the songs, if you share any of the enthusiasm: Sign up today!

#japan #anime #music #pop #indieweb #smallweb #web #webdev #html #programming #retro #tech #synth

Bookmarked [Discover the IndieWeb, one blog post at a time](https://indieblog.page/all).

↬ [Chuck Grimmett](https://cagrimmett.com/likes/16e3de6cf8/)

#indieweb #WebFeeds

(https://bddz.be/GZN)

Jumping in todays posting trend, app defaults

https://flamedfury.com/posts/app-defaults/

#blog #blogging #indieweb

Recently read an article about #posse and got fascinated around the #indieweb movement. Claiming your data is important. But if you can't, why not link back to a source that you actually own?

Any #IndieWeb folk heading to #ffconf next week? I’m wondering if anyone fancies a little informal Homebrew Website Club, or maybe just a coffee or a pint.