Server-server authentication

[jonasschneider]

As of now there is no backchannel identify verification of a POST /followers. Somebody could make me follow every known Tent identity (probably multiple times with some URL twiddling) and DDoS my server.

This is because the Discover -> Create -> Notify path requires no auth at all but still allows me to create the Follower and the NotificationSubscription. A scheme like the one used in PubSubHubbub to verify the call could be used to address this.

[titanous]

Yeah, this is a good point. We'll add verification to the follow flow.

[titanous]

This was implemented in tent/tentd@9771924, docs to come soon.