Align Follow tutorials with Fedify's origin-based security model

[dahlia]

Fedify's Follow examples were written before the origin-based security model from FEP-fe34 was introduced. Several tutorials therefore still treated an activity embedded by another origin as authoritative. The most visible failure occurred while handling Accept(Follow): calling accept.getObject() across the origin boundary caused Fedify to discard the inline Follow and dereference its ID instead. Because the tutorial had assigned an arbitrary ID without an object dispatcher, that request reached an HTML application route and failed while being parsed as ActivityStreams JSON.

Setting crossOrigin: "trust" would hide the immediate error, but it would also teach readers to bypass the boundary that Fedify now uses to distinguish an authoritative object from an untrusted copy. That is especially undesirable in introductory material, where examples tend to become production code. The examples should make the secure path the natural path.

The revised flow uses an activity ID as the reference carried by Accept, rather than embedding the whole Follow. For outbound requests, the tutorials record the request before sending it and use that local state to correlate the reply. docs/tutorial/microblog.md also gives each outgoing Follow a dispatcher-backed ID, so a remote server can dereference the authoritative activity at its origin, while the local inbox can verify the reply without making an HTTP request back to itself.

The matching rules preserve interoperability without weakening the origin check. An exact match against the stored activity ID is preferred. A peer-minted ID may fall back to an authenticated remote actor only when the ID belongs to a remote origin and the pending request is unambiguous; a mismatched ID on the local origin is rejected. The same reasoning covers shared-inbox delivery, where no local recipient is available in the request context, and retries reuse the stored request identity instead of minting an ID that a later Accept cannot match.

The simpler inbound examples now put follow.id in Accept.object, and the outbound examples no longer call getObject() merely to inspect a cross-origin inline Follow. The related guidance in docs/manual/context.md, docs/manual/context-advanced.md, docs/manual/inbox.md, and docs/manual/migrate.md was updated for the same reason. The framework examples and .agents/skills/create-example-app-with-integration/example/src/federation.ts follow the same pattern so newly generated integrations do not reintroduce the unsafe example.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 571323e8-b74f-4463-ba42-dcc93117598b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.