var Component=(()=>{var u=Object.create;var a=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var g=Object.getPrototypeOf,y=Object.prototype.hasOwnProperty;var b=(t,n)=>()=>(n||t((n={exports:{}}).exports,n),n.exports),f=(t,n)=>{for(var i in n)a(t,i,{get:n[i],enumerable:!0})},c=(t,n,i,s)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of m(n))!y.call(t,r)&&r!==i&&a(t,r,{get:()=>n[r],enumerable:!(s=p(n,r))||s.enumerable});return t};var v=(t,n,i)=>(i=t!=null?u(g(t)):{},c(n||!t||!t.__esModule?a(i,"default",{value:t,enumerable:!0}):i,t)),w=t=>c(a({},"__esModule",{value:!0}),t);var l=b((P,o)=>{o.exports=_jsx_runtime});var x={};f(x,{default:()=>h,frontmatter:()=>k});var e=v(l()),k={title:"Are Webmentions secure and private?",description:"Understanding the security and privacy implications of Webmentions, including common concerns and how to protect your site and users.",category:"privacy-security",order:1,published:!0};function d(t){let n={a:"a",code:"code",h2:"h2",h3:"h3",input:"input",li:"li",ol:"ol",p:"p",pre:"pre",span:"span",strong:"strong",ul:"ul",...t.components};return(0,e.jsxs)(e.Fragment,{children:[(0,e.jsx)(n.p,{children:"Webmentions are designed with security in mind, but like any web technology, they require proper implementation and understanding to keep your site and users safe."}),` `,(0,e.jsxs)(n.h2,{id:"security-fundamentals",children:[(0,e.jsx)(n.a,{"aria-hidden":"true",tabIndex:"-1",href:"#security-fundamentals",children:(0,e.jsx)(n.span,{className:"icon icon-link"})}),"Security Fundamentals"]}),` `,(0,e.jsxs)(n.h3,{id:"the-verification-requirement",children:[(0,e.jsx)(n.a,{"aria-hidden":"true",tabIndex:"-1",href:"#the-verification-requirement",children:(0,e.jsx)(n.span,{className:"icon icon-link"})}),"The Verification Requirement"]}),` `,(0,e.jsxs)(n.p,{children:["The most important security feature is ",(0,e.jsx)(n.strong,{children:"mandatory verification"}),":"]}),` `,(0,e.jsx)(n.pre,{children:(0,e.jsx)(n.code,{className:"language-javascript",children:`// \u274C NEVER do this - accepting without verification app.post('/webmention', (req, res) => { const { source, target } = req.body; saveMention(source, target); // Dangerous! res.send('OK'); }); // \u2705 ALWAYS verify app.post('/webmention', async (req, res) => { const { source, target } = req.body; // Accept immediately res.status(202).send('Accepted'); // Verify asynchronously const isValid = await verifyLink(source, target); if (isValid) { saveMention(source, target); } }); `})}),` `,(0,e.jsx)(n.p,{children:"This prevents:"}),` `,(0,e.jsxs)(n.ul,{children:[` `,(0,e.jsx)(n.li,{children:"Fake mentions from non-existent pages"}),` `,(0,e.jsx)(n.li,{children:"Spam claiming to link when they don't"}),` `,(0,e.jsx)(n.li,{children:"Impersonation attempts"}),` `]}),` `,(0,e.jsxs)(n.h3,{id:"async-processing",children:[(0,e.jsx)(n.a,{"aria-hidden":"true",tabIndex:"-1",href:"#async-processing",children:(0,e.jsx)(n.span,{className:"icon icon-link"})}),"Async Processing"]}),` `,(0,e.jsx)(n.p,{children:"Always process Webmentions asynchronously:"}),` `,(0,e.jsxs)(n.p,{children:[(0,e.jsx)(n.strong,{children:"Why?"})," Fetching the source URL synchronously creates attack vectors:"]}),` `,(0,e.jsx)(n.pre,{children:(0,e.jsx)(n.code,{className:"language-javascript",children:`// \u274C Vulnerable to slowloris attacks app.post('/webmention', async (req, res) => { await fetch(req.body.source); // Attacker can make this slow! res.send('OK'); // Ties up your server }); // \u2705 Protected app.post('/webmention', async (req, res) => { await queue.add(req.body); // Queue it res.status(202).send('Accepted'); // Return immediately }); // Process in background worker queue.process(async (job) => { await verifyMention(job.data); }); `})}),` `,(0,e.jsxs)(n.h2,{id:"common-security-threats",children:[(0,e.jsx)(n.a,{"aria-hidden":"true",tabIndex:"-1",href:"#common-security-threats",children:(0,e.jsx)(n.span,{className:"icon icon-link"})}),"Common Security Threats"]}),` `,(0,e.jsxs)(n.h3,{id:"1-ssrf-server-side-request-forgery",children:[(0,e.jsx)(n.a,{"aria-hidden":"true",tabIndex:"-1",href:"#1-ssrf-server-side-request-forgery",children:(0,e.jsx)(n.span,{className:"icon icon-link"})}),"1. SSRF (Server-Side Request Forgery)"]}),` `,(0,e.jsx)(n.p,{children:"Attackers could try to make your server fetch internal URLs:"}),` `,(0,e.jsx)(n.pre,{children:(0,e.jsx)(n.code,{className:"language-javascript",children:`// Malicious mention { source: "http://localhost:6379/", // Redis target: "https://yoursite.com/post" } `})}),` `,(0,e.jsx)(n.p,{children:(0,e.jsx)(n.strong,{children:"Protection:"})}),` `,(0,e.jsx)(n.pre,{children:(0,e.jsx)(n.code,{className:"language-javascript",children:`function isPublicUrl(url) { const parsed = new URL(url); const hostname = parsed.hostname; // Block private IPs const privateRanges = [ /^localhost$/i, /^127\\./, /^10\\./, /^172\\.(1[6-9]|2[0-9]|3[01])\\./, /^192\\.168\\./, /^169\\.254\\./, // Link-local /^::1$/, // IPv6 localhost /^fe80::/i, // IPv6 link-local ]; if (privateRanges.some(range => range.test(hostname))) { throw new Error('Private IP not allowed'); } // Block cloud metadata endpoints if (hostname === '169.254.169.254') { throw new Error('Cloud metadata endpoint blocked'); } // Only allow HTTP/HTTPS if (!['http:', 'https:'].includes(parsed.protocol)) { throw new Error('Invalid protocol'); } return true; } `})}),` `,(0,e.jsxs)(n.h3,{id:"2-xss-cross-site-scripting",children:[(0,e.jsx)(n.a,{"aria-hidden":"true",tabIndex:"-1",href:"#2-xss-cross-site-scripting",children:(0,e.jsx)(n.span,{className:"icon icon-link"})}),"2. XSS (Cross-Site Scripting)"]}),` `,(0,e.jsx)(n.p,{children:"Malicious content in mentions:"}),` `,(0,e.jsx)(n.pre,{children:(0,e.jsx)(n.code,{className:"language-html",children:`

Privacy & Security