Manually set ContentType for Response

[justindthomas]

I think I'm seeing some problems in my ActivityPub applications related to requesting servers being strict about content-type of responses matching their accept headers.

Here's what I see in my Rocket applications. One of my components will make a request out to a server to pull in some data.

runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:09Z DEBUG enigmatick::runner::announce] running process_remote_announce job
runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:09Z DEBUG enigmatick::runner::announce] RETRIEVING ANNOUNCE: ead0908e-a50d-4465-82ae-e0f84fb10a95
runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:09Z DEBUG enigmatick::runner::note] PERFORMING REMOTE LOOKUP FOR NOTE: https://toot.lgbt/users/FuchsiaShock/statuses/111987078879866692
runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:10Z DEBUG enigmatick::activity_pub::retriever] SIGNING REQUEST FOR REMOTE RESOURCE
runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:10Z DEBUG reqwest::connect] starting new connection: https://toot.lgbt/
runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:11Z ERROR enigmatick::runner::note] REMOTE NOTE FETCH STATUS 401
runner-66b97c8fc8-pd7jv runner [2024-02-24T18:21:11Z ERROR enigmatick::runner::note] Ok(
runner-66b97c8fc8-pd7jv runner         "{\"error\":\"Unable to fetch key JSON at https://enigmatick.social/user/enigmatick.social#main-key\"}",
runner-66b97c8fc8-pd7jv runner     )

That generates a request from the receiving server back to mine to get a public verification key to confirm the authenticity of the request. That 401 response above is an indication that that request failed. The below exchange is what that key request looks like.

core-689dbf4f78-58d9p core [2024-02-24T18:21:11Z DEBUG rocket::server] Received request: Request {
core-689dbf4f78-58d9p core         method: GET,
core-689dbf4f78-58d9p core         uri: /user/enigmatick.social,
core-689dbf4f78-58d9p core         version: HTTP/1.1,
core-689dbf4f78-58d9p core         headers: {
core-689dbf4f78-58d9p core             "host": "enigmatick.social",
core-689dbf4f78-58d9p core             "x-real-ip": "...",
core-689dbf4f78-58d9p core             "x-forwarded-for": "...",
core-689dbf4f78-58d9p core             "x-forwarded-proto": "http",
core-689dbf4f78-58d9p core             "connection": "close",
core-689dbf4f78-58d9p core             "user-agent": "http.rb/5.1.1 (Mastodon/4.2.7; +https://toot.lgbt/)",
core-689dbf4f78-58d9p core             "date": "Sat, 24 Feb 2024 18:21:11 GMT",
core-689dbf4f78-58d9p core             "accept-encoding": "gzip",
core-689dbf4f78-58d9p core             "accept": "application/activity+json, application/ld+json",
core-689dbf4f78-58d9p core             "signature": "keyId=\"https://toot.lgbt/actor#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date accept\",signature=\"BwY8mw4paimcPdjlLcFI8ccWC2pbJyKURDplIQ9GAM+ePt9gNtczeunZ1kFdJJzgT84Ogoy27cN2LJEga9IdWYCllKEhVLUUBhW+koy5+Qi4+1NZ0ne3fXEqq93q2vvsjdYnyLenyklz53xqxYme9C45JeVdDbnvvyb8oDGV8tcm4+LtXYYcfqihOVw37bk0TdIB2UAqHpe5DrI7yBiqWFFEoI3yT9r5iycNIBV21UYmKbJE09Iar3G1uLYGC66iFMqawoBw2dyJ3cwS0V3jaBajWLFsWoRN3as6nRbFvDMnEjsEmFv9xhVgodRut9TP1sIjkU52Yo8PJBoSD7/UCA==\"",
core-689dbf4f78-58d9p core             "x-varnish": "595539",
core-689dbf4f78-58d9p core         },
core-689dbf4f78-58d9p core         body: Body(
core-689dbf4f78-58d9p core             Empty,
core-689dbf4f78-58d9p core         ),
core-689dbf4f78-58d9p core     }
core-689dbf4f78-58d9p core [2024-02-24T18:21:11Z INFO  rocket::server] GET /user/enigmatick.social application/activity+json:
core-689dbf4f78-58d9p core [2024-02-24T18:21:11Z INFO  rocket::server::_] Matched: (person) GET /user/<username> [2]
core-689dbf4f78-58d9p core [2024-02-24T18:21:11Z INFO  rocket::server::_] Outcome: Success(200 OK)
core-689dbf4f78-58d9p core [2024-02-24T18:21:11Z DEBUG rocket::server] sending response: Response {
core-689dbf4f78-58d9p core         status: 200,
core-689dbf4f78-58d9p core         version: HTTP/1.1,
core-689dbf4f78-58d9p core         headers: {
core-689dbf4f78-58d9p core             "content-type": "application/json",
core-689dbf4f78-58d9p core             "server": "Rocket",
core-689dbf4f78-58d9p core             "permissions-policy": "interest-cohort=()",
core-689dbf4f78-58d9p core             "x-content-type-options": "nosniff",
core-689dbf4f78-58d9p core             "x-frame-options": "SAMEORIGIN",
core-689dbf4f78-58d9p core             "content-length": "1629",
core-689dbf4f78-58d9p core         },
core-689dbf4f78-58d9p core         body: Body(
core-689dbf4f78-58d9p core             Streaming,
core-689dbf4f78-58d9p core         ),
core-689dbf4f78-58d9p core     }
core-689dbf4f78-58d9p core [2024-02-24T18:21:11Z INFO  rocket::server::_] Response succeeded.

The key request has an accept header of application/activity+json, application/ld+json and my server responds with a content-type of application/json because it's a Json struct:

#[get("/user/<username>", rank = 2)]
pub async fn person(conn: Db, username: String) -> Result<Json<ApActor>, Status> {
    match get_profile_by_username((&conn).into(), username).await {
        Some(profile) => Ok(Json(ApActor::from(profile).load_ephemeral(conn).await)),
        None => Err(Status::NoContent),
    }
}

The data retrieved from the endpoint looks exactly like what I see from other ActivityPub servers, so I'm pretty sure that the data itself is not the problem. I'm left with the possibility that the mismatch in accept and content-type may have a role. But I can't see how I can fix that. Is there a way for me to manually set the content-type in Rocket?

As a last resort, all of this passes through an nginx server (for production) or proxied through a SvelteKit server (for development). I can probably change the header there if I need to. But that's really ugly.

[justindthomas]

I went ahead and implemented my hack in nginx and that seems to be working; I see retrievals working from https://infosec.exchange which have always generated 401 errors in the past like you see above.

For now, enigmatick.social is fronted by nginx (and varnish) with the header rewritten. enigmatick.jdt.dev is not fronted by nginx so you can see (when the server is up) the unaltered responses from Rocket there.

➜  ~ curl -H "accept: application/activity+json" -I https://enigmatick.social/user/enigmatick.social\#main-key
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 24 Feb 2024 19:50:39 GMT
Content-Length: 1629
permissions-policy: interest-cohort=()
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
Content-Type: application/activity+json
X-Varnish: 428703
Age: 0
Via: 1.1 varnish (Varnish/7.1)
Accept-Ranges: bytes
Connection: keep-alive

➜  ~ curl -H "accept: application/activity+json" -I https://enigmatick.jdt.dev/user/enigmatick.jdt.dev\#main-key
HTTP/1.1 200 OK
Server: nginx/1.22.1
Date: Sat, 24 Feb 2024 19:50:56 GMT
Content-Type: application/json
Content-Length: 1650
Connection: keep-alive
Access-Control-Allow-Origin: *
x-content-type-options: nosniff
permissions-policy: interest-cohort=()
x-frame-options: SAMEORIGIN

[SergioBenitez]

Consider implementing your own JSON-like responder that sets the proper content-type. Doing so is rather easy:

#[derive(Responder)]
#[response(content_type = "application/activity+json")]
struct ActivityJson<T>(Json<T>);

Then just respond with an ActivityJson<T> where you would normally use a Json<T>.

[justindthomas]

Awesome - thank you for the guidance. I'll do that.