Token links for social media postings

[jeyemwey]

When I’m following a person on the fediverse, I may see the links to their checkins that they did using their private Träwelling profile, but when i click the link, I’m greeted with a 401/403.

If the site would post a signed URL of the status to mastodon, it could later identify the visitors from there: „Although you don’t follow the person on the train, you have somehow gotten the secret link to the checkin and I can offer you at least those details now.“

Since this is changing the way that privacy works on Träwelling, we should make this setting optional (I’d propose a checkbox below the „How do you want to post the status“ setting) and off by default. A paragraph or two in the documentation could also help (with a link from settings?).

Laracast has a recent YouTube video on how to work with signed links which gave me the inspiration.

Let me know what you think :)

[HerrLevin]

One comment that just came to mind: This will most likely break down the road with a vue.js frontend/API backend.

[jeyemwey]

Because the API request calls a different route than the frontend page, and that API route is not in the signed data?

That makes sense, maybe we'd have to handroll the signature check then. Oarrr