Fake webId on LongChat
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10
- Forks
- 5
- Avg merge
- 2m
- Merged PRs (30d)
- 3
Description
For Solidarity, or any LongChat on Solid, it is really easy to make a fake message as @aveltens pointed.
As the folder is open to everyone in writing, @aveltens wrote a message with a dc:creator Tim's webId. So I thought Tim has wrote the message.
And everyone can make a message with any webId.
This is a real problem, how can we be sure that the message is posted by the good webId
Can the server allow only writing when the webId is the same as the dc:creator ? But I use ldflex-query, that don't use batch/transaction, so how could be a whole transaction ( a group of statements ) blocked if webId is not dc:creator ?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the LongChat write path and how ldflex-query creates messages on Solid. Determine how the server can authenticate the writing webId and validate dc:creator for a complete message, including grouped statements. Done means messages cannot be posted under another person's webId.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100