WebFinger-Canary

WebFinger Split-Domain Canary
<https://fietkau.software/webfinger_canary>

Julian Fietkau, 2024

This is a short, quick and dirty WSGI script using Flask to showcase a scenario where a
fediverse "handle" (the double-@ form, e.g. @alice@example.com) and the corresponding actor URI
exist on different domains. This is entirely valid as far as WebFinger is concerned, and is
supported at least partially by many popular fediverse platforms. However, some show the wrong
domain on the public profile pages generated for the remote account. This demo is intended to
make issues like that easier to identify and test.

Setup: Configure two different WSGI hostnames, one starting with the "correct." subdomain and
the other with the "wrong." subdomain, and point them both at this script. It will serve
a fediverse Actor with the WebFinger-supported handle of "@canary@correct.[your-domain]" and an
Actor ID of "https://wrong.[your-domain]/canary". It'll run happily on http as well, but
many fediverse platforms refuse to interact with non-https servers, so you'll probably want to
set up a certificate.

Released to the public under Creative Commons Zero 1.0. Do what you want with it!

The bird logo/avatar is a modified version of this OpenClipArt image:
https://publicdomainvectors.org/en/free-clipart/Cute-bird/37651.html

Special Thanks to Jeff Sikes (@box464@mastodon.social) for help with platform tests.