3 ms·
ActivityPub would not appear to be a focus for the mainline Mastodon team. My tests show that most ActivityPub endpoints of the main Mastodon server software ar
by esbranson 3y ago
ActivityPub would not appear to be a focus for the mainline Mastodon team. My tests show that most ActivityPub endpoints of the main Mastodon server software are not CORS enabled so are unreachable by webapps. They are public endpoints and should obviously be CORS enabled. For a HTTP-based protocol, this is a glaring oversight. (It's fixed by at least some other Mastodon servers like Glitch.) Most other ActivityPub implementations correctly enable CORS. CORS is just an example of the treatment that ActivityPub gets.
- dingnuts 3y agoThe ActivityPub endpoints are not CORS enabled because requests to those endpoints are supposed to come from homeservers, not from users' clients. That's the server-to-server protocol, not the client-to-server protocol.
- esbranson 3y agoMastodon devs admit some endpoints should be CORS enabled, and did so. Whatever you do to make this fact "fit" your logic should be extended to the other endpoints. Glitch already extended it.