Federation with GoToSocial fails

[filipesmedeiros]

When trying to follow the same flow as with Mastodon, things fails when trying to use a GoToSocial instance.

I don't have lots of details, because logs are not super clarifying on either side, but something that goes wrong right from the get go is that when following an event account from GoToSocial, it is interpreted as "follow request" instead of a pure follow. So it seems that GoToSocial is seeing the event account as "closed" (follow-request), whereas Mastodon seems to be able to just follow the event without the request.

I'll add more information when I get the time.

[filipesmedeiros]

Opened an issue on GtS as well: https://codeberg.org/superseriousbusiness/gotosocial/issues/4170

[filipesmedeiros]

Logs from my GtS instance when I try to follow an event on https://gath.io:

Logs

``` timestamp="12/05/2025 11:37:26.505" func=server.init.func2.Logger.19.1 level=INFO latency="2.093258ms" userAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0" method=GET statusCode=200 path=/api/v1/timelines/home clientIP=78.153.176.181 requestID=wwwxqgwp04000phn1bpg msg="OK: wrote 26B"

timestamp="12/05/2025 11:37:28.515" func=server.init.func2.Logger.19.1 level=INFO latency="79.901µs" userAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0" method=OPTIONS statusCode=204 path=/api/v1/accounts/01JV1XG837YEB7JSQSPEZ9MZZE/follow clientIP=100.65.39.1 requestID=rd0xqgwp04001f8fjfy0 msg="No Content: wrote 0B"

timestamp="12/05/2025 11:37:28.540" func=workers.(*Processor).ProcessFromClientAPI level=INFO activityType=Create objectType=Follow fromAccount=filipe msg="processing from client API"

timestamp="12/05/2025 11:37:28.540" func=server.init.func2.Logger.19.1 level=INFO latency="3.438965ms" userAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0" method=POST statusCode=200 path=/api/v1/accounts/01JV1XG837YEB7JSQSPEZ9MZZE/follow clientIP=78.153.176.181 requestID=v10xqgwp04000vd62q2g msg="OK: wrote 178B"

timestamp="12/05/2025 11:37:28.541" func=federation.(*federatingActor).Send level=INFO msg="send activity Follow via outbox https://social.filipesm.eu/users/filipe/outbox"

timestamp="12/05/2025 11:37:28.654" func=server.init.func2.Logger.19.1 level=INFO latency="52.083µs" userAgent="" method=GET statusCode=418 path=/users/filipe/main-key clientIP=167.71.138.200 requestID=9s1dqgwp04001xdmktf0 msg="I'm a teapot: wrote 58B"

timestamp="12/05/2025 11:37:28.672" func=httpclient.(*Client).DoOnce level=INFO method=POST url=https://gath.io/activitypub/inbox contentType="application/ld+json; profile="https://www.w3.org/ns/activitystreams\"" attempt="1" pubKeyID=https://social.filipesm.eu/users/filipe/main-key msg="401 Unauthorized"

</details>

[tsmethurst]

I believe this will be resolved by gathio setting a user agent when doing http requests. GtS rejects requests without a user agent with code 418.

[filipesmedeiros]

Seems like these would be the relevant lines to change?

gathio/src/activitypub.js

Lines 215 to 229 in 69f7500

	request(
	{
	url: inbox,
	headers: {
	Host: targetDomain,
	Date: d.toUTCString(),
	Signature: header,
	Digest: `SHA-256=${digest}`,
	"Content-Type": activityPubContentType,
	Accept: activityPubContentType,
	},
	method: "POST",
	json: true,
	body: message,
	},

What would a good user agent string look like here, @tsmethurst? Thanks!

EDIT: There a couple more places in that file

gathio/src/activitypub.js

Lines 666 to 673 in 69f7500

	request(
	{
	url: req.body.actor,
	headers: {
	Accept: activityPubContentType,
	"Content-Type": activityPubContentType,
	},
	},

(and two more I think)

[filipesmedeiros]

I tested and it kinda worked (adding the User Agent). Still not functional, but further along.

Now we hit this line

gathio/src/activitypub.js

Line 1276 in 69f7500

console.log("No action taken");

Which means that this condition is false

gathio/src/activitypub.js

Lines 1212 to 1215 in 69f7500

	if (typeof req.body.object === "string" && req.body.type === "Follow") {
	console.log("Sending to _handleFollow");
	_handleFollow(req, res);
	}

Is there anything here that is easily identifiable as a bug on either side?

[lowercasename]

If you let me join your GtS instance, I can do some testing against a locally running Gathio instance I've set up with Cloudflare Tunnel (you could do something similar yourself, or use Ngrok or similar). Or I can spin up my own GtS instance, but it'll be a little while until I've got free time to do so.

[filipesmedeiros]

I created an instance for you: https://gts-gathio.filipesm.uber.space

Just use any Mastodon-like client (I recommend https://phanpy.social).

Username is some_username1, password was sent to you by encrypted email :) It's an admin account, btw

Just let me know when you're done with testing, so I can spin down the instance and delete the data!

[lowercasename]

So sorry it's taken me so long - I'm just looking at this now. Looks like GTS insists on my username being an email:

[filipesmedeiros]

@lowercasename sorry, I should've given you the email, yeah! The email is this "some_email@whatever.org"

[lowercasename]

Just dumping some research here - when Gathio's Express server receives requests from GTS, it doesn't think the requests have a body. Unlikely this is actually the case, but here are the headers and body logged from an Unfollow/Follow event from Mastodon and then from GTS:

{
  host: 'gathio-localhost.idiot.sh',
  'user-agent': 'Mastodon/4.3.8 (http.rb/5.2.0; +https://hachyderm.io/)',
  'content-length': '369',
  'accept-encoding': 'gzip, br',
  'cdn-loop': 'cloudflare; loops=1',
  'cf-connecting-ip': '2a01:4f8:10a:d68::2',
  'cf-ipcountry': 'DE',
  'cf-ray': '9667cb18ec1f4d5b-FRA',
  'cf-visitor': '{"scheme":"https"}',
  'cf-warp-tag-id': 'e1f94577-5a11-4156-a3f7-8907ea3833c5',
  connection: 'keep-alive',
  'content-type': 'application/activity+json',
  date: 'Mon, 28 Jul 2025 22:25:36 GMT',
  digest: 'SHA-256=BQsMAKArAnzmHJkTzRwUuq8fjZdnU0LjVbaRj2kCDCc=',
  signature: 'keyId="https://hachyderm.io/users/lown#main-key",algorithm="rsa-sha256",headers="host date digest content-type (request-target)",signature="TX5Vw8/wmuhP8SQYJ5Ibs3IcOkbjEPmqK3PyB4ZbexVEN9M97HBGaHN60h2OdE8NcoBowKGKnNpWycb/wpoXc/ykVKNLcrMW3BfTF3CLyfjT1lsRTR298/zYxpYpxxA2aYIjejGXpFa14OpHU/8RkOYh4U4/rIbBfrCXCVjpdyJ5S3YaDm7dGAjl9A7OhBOtYNEWZMBABNlIfoRJ9SOxjot7RSMXl31fuN+CD9pm9CIYqDPLbEkslsvFekpyivAFLU/wl84gQig5a3RlvuS/yxB8RsULN2olQNLvlSlVFmbzd7vxmNnzPifaSACZ2ZTQ0SI3x2fgysSmYzGkwg7xKg=="',
  'x-forwarded-for': '2a01:4f8:10a:d68::2',
  'x-forwarded-proto': 'https'
}
{
  '@context': 'https://www.w3.org/ns/activitystreams',
  id: 'https://hachyderm.io/users/lown#follows/4328933/undo',
  type: 'Undo',
  actor: 'https://hachyderm.io/users/lown',
  object: {
    id: 'https://hachyderm.io/f766a95a-df78-44e8-8cc9-71bf21d702ad',
    type: 'Follow',
    actor: 'https://hachyderm.io/users/lown',
    object: 'https://gathio-localhost.idiot.sh/tCnq9K6O78Al5Ro_Uqbr_'
  }
}
{
  host: 'gathio-localhost.idiot.sh',
  'user-agent': 'Mastodon/4.3.8 (http.rb/5.2.0; +https://hachyderm.io/)',
  'content-length': '242',
  'accept-encoding': 'gzip, br',
  'cdn-loop': 'cloudflare; loops=1',
  'cf-connecting-ip': '2a01:4f8:13a:1b2b::2',
  'cf-ipcountry': 'DE',
  'cf-ray': '9667cb48e8989752-FRA',
  'cf-visitor': '{"scheme":"https"}',
  'cf-warp-tag-id': 'e1f94577-5a11-4156-a3f7-8907ea3833c5',
  connection: 'keep-alive',
  'content-type': 'application/activity+json',
  date: 'Mon, 28 Jul 2025 22:25:43 GMT',
  digest: 'SHA-256=2o1n3k/8jn4HI+P/+ryM6cnw0tlli8tXZ3UZyDTnyEU=',
  signature: 'keyId="https://hachyderm.io/users/lown#main-key",algorithm="rsa-sha256",headers="host date digest content-type (request-target)",signature="TtNB7jgAvuJTpR8OyR3DhQwU6m4JJCcMpzu/TJDjzd3fIYlPuRTtMmlmmE+TIAYNOUMjNdE0YOiZXPbbjpbNZXZ2giAzqcMzdePrVgE+99M+oLDdUhnytw0opM4Fup/BrwamKM2sOabdPtykxxBMzGok0TYPvRybdB1+odZhoUjPyFq3VtFm1Spze5nnvP75hgrsuPcAviwFi2lRSgsbfjpUs4hfT4gigi4UznSJdw4JLul28Zx208GqYw8yu8x6eDm5Q4zuI6lGO6kEB/zccKM7Jw6aeTO/Uixfenk0qI7OTXHNAwH4Bm+to2EKvAB7IGlcBfY5aoR8IvrJI4EAAQ=="',
  'x-forwarded-for': '2a01:4f8:13a:1b2b::2',
  'x-forwarded-proto': 'https'
}
{
  '@context': 'https://www.w3.org/ns/activitystreams',
  id: 'https://hachyderm.io/8187fd2e-a4dc-491d-b44e-025ec114d83e',
  type: 'Follow',
  actor: 'https://hachyderm.io/users/lown',
  object: 'https://gathio-localhost.idiot.sh/tCnq9K6O78Al5Ro_Uqbr_'
}

{
  host: 'gathio-localhost.idiot.sh',
  'user-agent': 'gotosocial/0.19.1+git-6574dc8 (+https://gts-gathio.filipesm.uber.space)',
  'content-length': '600',
  'accept-charset': 'utf-8',
  'accept-encoding': 'gzip, br',
  'cdn-loop': 'cloudflare; loops=1',
  'cf-connecting-ip': '95.143.172.202',
  'cf-ipcountry': 'DE',
  'cf-ray': '9667cb9a799bd3ae-FRA',
  'cf-visitor': '{"scheme":"https"}',
  'cf-warp-tag-id': 'e1f94577-5a11-4156-a3f7-8907ea3833c5',
  connection: 'keep-alive',
  'content-type': 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
  date: 'Mon, 28 Jul 2025 22:25:56 GMT',
  digest: 'SHA-256=chBKsLNWZ3FOPofaUgjvoRkgkQX9xm8t4cWEzpSUUkk=',
  signature: 'keyId="https://gts-gathio.filipesm.uber.space/users/some_username1/main-key",algorithm="hs2019",headers="(request-target) host date digest",signature="Mp/wHvMlwYybTmOU8nwlyVraA77WDNDiyQIyLpKnF7C+1Q8U4+JokMvwOKNqvaIwBaSyBBKoSddjq0htqeBHBS7OHl78YkZee4jZkUEkgDKXE3EAQEMqCkF9gErKKLXT1rFDdvRDuFRSH5wCvp9kTBUHtGkboEksOXvbde8xsisvBS5BvcQE6szQaXR/6nfqSfh6CETkuMYNFk/B6Iho6WyFfwJ547GNUu0i/8KN7mW9uAa2Mxc3JPgw3xiqdSrT4e50m+JMxlqh59+UMAUwqFFUb3hoUX/XrQKD+C+4SjKwU6aApL7Rv7y4D5W/NtX/1BjlyHd/oXJ8dWfz+z5NDQ=="',
  'x-forwarded-for': '95.143.172.202',
  'x-forwarded-proto': 'https'
}
{}
{
  host: 'gathio-localhost.idiot.sh',
  'user-agent': 'gotosocial/0.19.1+git-6574dc8 (+https://gts-gathio.filipesm.uber.space)',
  'content-length': '369',
  'accept-charset': 'utf-8',
  'accept-encoding': 'gzip, br',
  'cdn-loop': 'cloudflare; loops=1',
  'cf-connecting-ip': '95.143.172.202',
  'cf-ipcountry': 'DE',
  'cf-ray': '9667cbae2f74d3ae-FRA',
  'cf-visitor': '{"scheme":"https"}',
  'cf-warp-tag-id': 'e1f94577-5a11-4156-a3f7-8907ea3833c5',
  connection: 'keep-alive',
  'content-type': 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
  date: 'Mon, 28 Jul 2025 22:26:00 GMT',
  digest: 'SHA-256=AYFBiJpJ/InNCe6uCRiy7xAKDWk+WJeYLIQqimtYC8s=',
  signature: 'keyId="https://gts-gathio.filipesm.uber.space/users/some_username1/main-key",algorithm="hs2019",headers="(request-target) host date digest",signature="P95JSP1RH7SEDf8yTzLi1gXbCiZ2QCwk/uuzHF3tVzMXcCrnKhvtP4GNMZ/4pRZKjKKPgNQFGWT6VJZ60whT7BrIyFGIaGbf4LhDMsVESDYiyU4J4ZZvQkCIuvGe7+JxXmf2atVsjTqM1vV7jnVzSntns0g+6ZZz6uioypp/J2FJfY7xpSCt77P10MUvLJC7AyrYScI+oX6gQNu66I5jG83dbYHNB0ioerA6jHd6/pJeUK2j79dHTCWf9hDP6YVax2KSHuBW7uSdy6G9jd+S6onIlJQCaF/OAjavOBuBDIGSD1d3/cWNjg5nrgRTtR8WaiJlM6Lnfe0lP7+ORHlbwg=="',
  'x-forwarded-for': '95.143.172.202',
  'x-forwarded-proto': 'https'
}
{}

The one obvious thing that stands out at the moment is that Mastodon still uses the application/activity+json Content-Type header, while GTS uses the more modern application/ld+json; profile="https://www.w3.org/ns/activitystreams". We are meant to be parsing bodies using that header, but I wonder if we're not doing it correctly?

[lowercasename]

Turns out this is indeed a quirk of the Express JSON parser: expressjs/body-parser#519 (comment). Well, I thought I fixed it with this commit, which makes the parser parse these content types correctly, but it looks like maybe federation is just broken across the board at the moment, this will need more investigation.