Actor ID and public key ID have different URI schemes

[silverpill]

Hi, I discovered an actor where publicKey.id and publicKey.owner have http URI scheme. The admin says that configuration seems to be correct ("both site url and the activitypub url are https").

Example:

{
  "id": "https://ghost.example/.ghost/activitypub/users/index",
  "publicKey": {
    "id": "http://ghost.example/.ghost/activitypub/users/index#main-key",
    "owner": "http://ghost.example/.ghost/activitypub/users/index",
    "publicKeyPem": "...",
    "type": "CryptographicKey"
  }
}

Version (according to NodeInfo): 0.1.0

[zojl]

I faced with the same problem and found a solution.

Commonly, the ActivityPub service allows traffic via insecure http: https://github.com/TryGhost/ActivityPub/blob/main/src/http/middleware/role-guard.ts#L96
But my server is working with external reverse proxy which routes the traffic to ghost's caddy.
And the caddy was proxying trafic the same way as it written in official snippet: https://github.com/TryGhost/ghost-docker/blob/main/caddy/snippets/ActivityPub
As you can see, in this case caddy doesn't add the X-Forwarded-Proto header in this case.

So the solution was to add this header.
Like this, for example (which is bit shorter)

    # ActivityPub
    @activitypub {
        path /.ghost/activitypub/* 
        path /.well-known/webfinger
        path /.well-known/nodeinfo
    }
    handle @activitypub {
        reverse_proxy http://activitypub:8080 {
            header_up X-Forwarded-Proto https
        }
    }

I'm still not sure if there's a bug in the service implementation, 'cause NODE_ENV: production should be enough to prevent this, but with this workaround my activitypub instance started working well.