Authorization

The authorization module is responsible for loading information about remote actors from the headers of HTTP requests.

This is used in the process of checking if the current resource is available for these actors on fetch requests, or for making sure the activity being processed is authored by the expected actor in the case of activity processing ones.

It provides a unified API to extract the actor information from both client to server and server to server specific headers.

Client to server

For client to server requests it loads an OAuth2 bearer token from the Authorization header and it tries to load the corresponding access data from a storage implementation that alongside implements the osin.Storage interface, and then the actor that generated the token.

Server to server

For server to server requests, or authorized fetches the module tries to load a valid HTTP-Signature from the Signature header.

The key ID present in the signature information is used to find the owner actor based on some basic heuristics. The actor is then fetched from its remote server if a fresh representation can not be found in the local storage.

These actors are neccessary as inputs to the processing.ProcessActivity() calls.