#17734·misskey

`(request-target)` value in HTTP Signatures silently drops query string

Author: ClearlyClaireCreated Jul 17, 2026Updated Sep 12, 2026
Labels🌌Federation⚠️bug?

Misskey incorrectly leaves out part of the URI in HTTP Signatures, only keeping the path and ignoring the query string: https://github.com/misskey-dev/misskey/blob/0be4d352ec213b1f23977b4169f50a1149d104f2/packages/backend/src/core/activitypub/ApRequestService.ts#L123

This is an issue Mastodon had as well and fixed a while ago (while still temporarily accepting incorrect signatures). Background: https://github.com/mastodon/mastodon/pull/39516