zat
atproto utils for zig zat.dev
atproto sdk zig
Star 35
Fork 2
Watch

harden identity network resolution #25

Merged zat.dev
targeting main from codex/identity-network-safety
Merged opened by and assigned to zat.dev
targeting main from codex/identity-network-safety

Summary #

Adds network safety for identity resolution paths:

  • Rejects non-routable identity hosts and resolved A/AAAA answers
  • Uses DoH preflight before did:web and HTTP handle fetches
  • Dials the checked resolved address while preserving the original host for TLS/SNI
  • Disables redirects for identity and DoH fetches
  • Adds response size caps for DID docs, handle well-known responses, and DoH responses

Validation #

  • zig build test --summary all -freference-trace
  • just check && just test
  • Live identity smoke for zat.dev
  • Malicious DoH smoke returning 127.0.0.1
  • Response cap smoke
  • Resolved-dial smoke
  • atproto-bench temporary proof with local zat override
Commits 0