Fedify: ActivityPub server framework

@fedify@hollo.social

Fedify is an #ActivityPub server framework in #TypeScript & #JavaScript. It aims to eliminate the complexity and redundant boilerplate code when building a federated server app, so that you can focus on your business logic and user experience.

The key features it provides currently are:

Type-safe objects for Activity Vocabulary (including some vendor-specific extensions)
#WebFinger client and server
HTTP Signatures & Linked Data Signatures & Object Integrity Proofs
Middleware for handling webhooks
#NodeInfo protocol
#Node.js, #Deno, and #Bun support
CLI toolchain for testing and debugging

If you're curious, take a look at the #Fedify website! There's comprehensive docs, a demo, a tutorial, example code, and more:

https://fedify.dev/

@fedify@hollo.social · Reply to Fedify: ActivityPub server framework

Out of the box, #Fedify comes packed with features crucial for #fediverse development:

#WebFinger client and server
HTTP Signatures
Object Integrity Proofs
NodeInfo protocol
No need to reinvent the wheel—Fedify has you covered for core #ActivityPub standards! 📦

@fedify@hollo.social · Reply to Fedify: ActivityPub server framework

Flexibility is key! #Fedify isn't a full-stack solution—it's designed to work alongside your favorite web frameworks. Whether you're using #Astro, #Hono, #Fresh, or others, Fedify has got you covered with easy integration options. Build your #fediverse app, your way! 🛠️

@fedify@hollo.social · Reply to Fedify: ActivityPub server framework

One of #Fedify's strongest features is its type-safe vocabulary objects. These represent the Activity Vocabulary and vendor-specific extensions, ensuring robust and safe code when working with ActivityPub objects and activities. Say goodbye to runtime errors and hello to confident coding! 💪🏼

@fedify@hollo.social

Introducing #Fedify: A powerful #TypeScript library for building #ActivityPub server apps in the #fediverse! 🚀

Fedify aims to simplify the complex world of federated apps, allowing developers to focus on what matters most—their unique features and user experience. Let's explore what makes Fedify stand out! 🧵

https://unstable.fedify.dev/manual/integration#astro

@fedify@hollo.social

In #Fedify's next release, v0.12.0, we'll be adding support for integration with Astro, a web framework for content-driven websites.

#Astro #fedidev

@fedify@hollo.social

We released #Fedify 0.9.2, 0.10.1, and 0.11.1, which patched the last reported #vulnerability, CVE-2024-39687, but the vulnerability of SSRF attacks via DNS rebinding still exists, so we released Fedify 0.9.3, 0.10.2, and 0.11.2, which fixes it.

If you are using an earlier version, please update as soon as possible.

Thanks to @benaryorg for reporting the vulnerability!

#SSRF #security #fedidev

@fedify@hollo.social · Reply to Mitex Leo

@ml Apparently they (Ghost) have a bug. We'll inform them!

https://github.com/dahlia/fedify-h3

@fedify@hollo.social

We're releasing @fedify/h3! Now you can integrate #Fedify with h3, an HTTP server framework behind Nitro, Analog, Vinxi, SolidStart, TanStack Start, and other many web frameworks.

#fedidev #h3

@fedify@hollo.social · Reply to Mitex Leo

@ml What Mastodon client app do you use?

https://github.com/TryGhost/ActivityPub/blob/c82715db4529f9a71de8853d159ae26d576c385f/src/dispatchers.ts#L40

@fedify@hollo.social · Reply to silverpill

@silverpill Yeah, they apparently missed to wrap it with Image object! See their code:

It should be changed as like below (from @hollo):

https://github.com/dahlia/hollo/blob/7b51666bfdfd6efea511c03cd305432643e423b7/src/federation/index.ts#L86-L88

Alejandro Baez

@zeab@fosstodon.org

Woah, #ghost is now live in the #fediverse with @index.

Absolutely outstanding progress! #fedify definitely deserves a great deal of recognition for making this possible. 😎

Feeling like we now have tooling in place to fediverse all things. 😅

Ayo

@ayo@webtoo.ls

looks like there will be lighter-weight alternatives to mastodon, thanks to @fedify — maybe I’ll hack together a simple one? 🙃

https://github.com/TryGhost/ActivityPub

@fedify@hollo.social

Finally, @ghost has open sourced their #ActivityPub implementation powered by #Fedify! For Fedify users, this means another production-grade example code.

If you'd like to follow updates on #Ghost's ActivityPub implementation, you can do so by following @index!

#fedidev

Anuj Ahooja

@quillmatiq@mastodon.social

Two big pieces of news in Ghost's progress on ActivtyPub integration:

1. You can now follow their newsletter from the Fediverse at this address: @index
2. They've open sourced their ActivityPub work!

We're many steps closer to being able to follow Ghost newsletters on the #Fediverse rather than cluttering up your email inbox 🙏🏻

https://activitypub.ghost.org/lets-fix-it-in-production/?ref=build-log-newsletter

Emelia 👸🏻

@thisismissem@hachyderm.io · Reply to Fedify: ActivityPub server framework

@fedify users of Fedify still need to keep potential for SSRF in mind when requesting any URLs in Activities/Objects not through these APIs, e.g., when downloading media from a remote server for caching

technicat

@technicat@universeodon.com

I was planning to play around with #fedify but got sidetracked into learning #deno #fresh #preact #tailwindcss ...

Hollo

@hollo@hollo.social

To #Hollo users: please update your #Hollo to 0.1.0-dev.46, a #security patch which addresses @fedify's #vulnerability CVE-2024-39687, as soon as possible!

https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709

https://hollo.social/@fedify/019080c7-c784-755d-a6f2-d1f91f2c5709

@hongminhee@fosstodon.org

To #Fedify users: please update your Fedify as soon as possible!

@fedify@hollo.social

CVE-2024-39687, a vulnerability that could potentially allow a Server Side Request Forgery (SSRF) attack, was discovered in #Fedify and a security patch has been applied to fix it. The patched versions are 0.9.2, 0.10.1, and 0.11.1, respectively. If you are using an earlier version, please update as soon as possible.

Thanks to @thisismissem for reporting the vulnerability!

@fedify@hollo.social

Hooray, #Fedify's GitHub repository just hit 300 stars!

ALT text
Fedify's GitHub repository, which has over 300 stars.

Anuj Ahooja

@quillmatiq@threads.net · Reply to Tim Chambers

I've been using fedify for the last few months and I'm absolutely loving it. It makes it really easy to prototype new ideas.

https://writings.hongminhee.org/2024/07/ghost-funds-fedify/

@hongminhee@fosstodon.org

I jsut wrote a detailed post on my blog about @ghost's #funding for @fedify! (Both English and Korean available.)

#Fedify #fedidev

https://unstable.fedify.dev/manual/inbox#making-inbox-listeners-non-blocking

@hongminhee@fosstodon.org · Reply to 洪民憙 (Hong Minhee)

#Fedify now has a queue for incoming activities and they are automatically retried when they fail. The default retry strategy is good enough (exponential backoff + decorrelated jitter), and it's even fully customizable. Updated also the docs:

You can give it a try by installing 0.12.0-dev.265+cb851932, the latest unstable release:

https://jsr.io/@fedify/fedify@0.12.0-dev.265+cb851932
https://www.npmjs.com/package/@fedify/fedify/v/0.12.0-dev.265

@hongminhee@fosstodon.org

In the next version of #Fedify, the #RetryPolicy type is introduced to let you fully customize the retry policy of the task queue for incoming and outgoing activities. Of course, you can also simply adjust the parameters of the built-in exponential backoff + decorrelated jitter policy.

outboxRetryPolicy

This API is available since Fedify 0.12.0.

The retry policy for sending activities to recipients' inboxes.

By default, this uses an exponential backoff strategy with a maximum of 10 attempts and a maximum delay of 12 hours.

You can fully customize the retry policy by providing a custom function that satisfies the RetryPolicy type. Or you can adjust the parameters of the createExponentialBackoffRetryPolicy() function, which is a default implementation of the retry policy. — ALT text
outboxRetryPolicy This API is available since Fedify 0.12.0. The retry policy for sending activities to recipients' inboxes. By default, this uses an exponential backoff strategy with a maximum of 10 attempts and a maximum delay of 12 hours. You can fully customize the retry policy by providing a custom function that satisfies the RetryPolicy type. Or you can adjust the parameters of the createExponentialBackoffRetryPolicy() function, which is a default implementation of the retry policy.

https://hollo.social/@fedify/0190687b-1a09-728b-8a0d-bcbd4dca54cd

@hongminhee@fosstodon.org

Basic implementation of the inbox queue is complete and documentation is being worked on.

#Fedify #fedidev

Making inbox listeners non-blocking

This API is available since Fedify 0.12.0.

Usually, processes inside an inbox listener should be non-blocking because they may involve long-running tasks. Fortunately, you can easily turn inbox listeners into non-blocking by providing a queue option to createFederation() function. If it is not present, incoming activities are processed immediately and block the response to the sender until the processing is done.

While the queue option is not mandatory, it is highly recommended to use it in production environments to prevent the server from being overwhelmed by incoming activities.

Note: Activities with invalid signatures/proofs are silently ignored and not queued. — ALT text
Making inbox listeners non-blocking This API is available since Fedify 0.12.0. Usually, processes inside an inbox listener should be non-blocking because they may involve long-running tasks. Fortunately, you can easily turn inbox listeners into non-blocking by providing a queue option to createFederation() function. If it is not present, incoming activities are processed immediately and block the response to the sender until the processing is done. While the queue option is not mandatory, it is highly recommended to use it in production environments to prevent the server from being overwhelmed by incoming activities. Note: Activities with invalid signatures/proofs are silently ignored and not queued.

https://github.com/dahlia/fedify/issues/66#issuecomment-2198967566

@fedify@hollo.social

In the next version of #Fedify, the Context.hostname, Context.host, and Context.origin properties will be added for better multitenancy/virtual hosting support.

https://github.com/dahlia/fedify/issues/70

@fedify@hollo.social

#Fedify has always been queuing outgoing activities, but not incoming activities. Thanks to @ghost's sponsorship, we are now implementing queues for incoming activities!