Digest for POST with HttpURLConnection

[sventiffe]

I am trying to understand how Relays are working by writing one in Java. I want to post an Accept activity from a Java client to a Mastodon inbox. As of today, I am receiving a 401 message with Invalid Digest value. Computed SHA-256 digest: foo=; given: bar=

I do not understand the sequence though:

1. I create the Accept activity Json which has the Follow activity as payload
2. I create the HttpURLConnection object and add required request headers
3. I compute the digest for the Activity Json and set it as Digest header
4. I set the Signature header based on (request-target) host date digest
5. I open the connection

The Signature header value being used is: keyId="https://MYHOST/actor#main-key",headers="(request-target) host date digest",signature="SIGNATURE=="

At this point in time, the connection is rejected. I am not able to send the Json payload so the server had no way to compute the digest of the payload. If I compute the digest based on an empty string, the error does not appear anymore (but this hardly makes sense, does it?).

As far as I understand I've followed all steps that are required for HTTP signatures (although the documentation does not mention the need for a digest as also mentioned here.

1. What am I missing for making HTTP Signatures work?
2. Do I also need to add LD Signatures? (I would assume I would have to get past the Invalid Digest value error first in any case though?)

[nightpool]

Mastodon requires all actors to implement the WebFinger protocol, including relay actors. I'm not sure if you edited that part out of your question intentionally, but the .well-known/webfinger route (or the host-meta route, optionally) is required.

I couldn't speak to the HTTP signatures issues you're having, but it sounds like maybe an issue with the body you're sending in your request. If the body of your request is empty, then obviously the digest value will have to be empty as well. Maybe that's a place to start your debugging? I would also suggest looking up examples for how to send POST bodies with the Java libraries you're using for other tips and tricks.

[sventiffe]

WebFinger protocol

Thanks, yes! I've edited that out as it seems to be completely unrelated to the digest issue that I am trying to understand (and as once I figured it out, I've added it so that this data flow is working now).

body of your request is empty

Yes, this seems to be the issue. All examples I found so far require to open a connection, getting the output stream and sending the data. It just seems that once I open the connection, the digest is evaluated among other things which results in the 401 digest issue.

[sventiffe]

Indeed the digest issue is solved by sending the data before opening the connection (which will happen automatically). So an API usage mistake on my end (although I thought I've had it this way before, but your reply made me try again). Thanks!