fix(federation): add strict origin enforcement for user attribution (FED-010)

Prevent malicious peers from forging events attributed to users on other
instances. Every relay event processor now verifies the acting user's
homeInstance (from payload) matches X-Federation-Origin (from HMAC-verified
header) via verifyAttribution(), normalized to bare domain.

- Add verifyAttribution() helper using extractDomain normalization
- Guard all 13 event processors before any user resolution or DB writes
- Add homeInstance to FederationRelayReaction type + outbound payloads
- Replace unnormalized string equality in friend handlers
- Log mismatched values on rejection for debugging

This commit is contained in:

Jannis Braun

2026-03-31 19:16:48 +02:00

parent d0ed43cf58

commit 720a5de945

4 changed files with 101 additions and 18 deletions

									
										packages/shared/src/types.ts
									
		+1
		
												View File
												
				@@ -819,6 +819,7 @@ export interface FederationRelayReaction {

				  messageHomeInstance?: string;

				  userId: string;

				  homeUserId: string;

				  homeInstance: string;

				  emoji: string;

				  createdAt: number;

				}