diff --git a/source.html b/source.html index 2958825..a194f24 100644 --- a/source.html +++ b/source.html @@ -429,14 +429,14 @@

Hub Verifies Intent of the Subscriber

In order to prevent an attacker from creating unwanted subscriptions on behalf of a subscriber (or unsubscribing desired ones), a hub must ensure that the subscriber did indeed send the subscription request.

The hub verifies a subscription request by sending an HTTP [[!RFC7231]] (or HTTPS [[!RFC2818]]) GET request to the subscriber's callback URL as given in the subscription request. This request has the following query string arguments appended (format described in Section 4 of [[!URL]]):

-
hub.mode
-
REQUIRED. The literal string "subscribe" or "unsubscribe", which matches the original request to the hub from the subscriber.
-
hub.topic
+
hub.mode
+
REQUIRED. The literal string "subscribe" or "unsubscribe", which matches the original request to the hub from the subscriber.
+
hub.topic
REQUIRED. The topic URL given in the corresponding subscription request.
-
hub.challenge
+
hub.challenge
REQUIRED. A hub-generated, random string that MUST be echoed by the subscriber to verify the subscription.
-
hub.lease_seconds
-
REQUIRED/OPTIONAL. The hub-determined number of seconds that the subscription will stay active before expiring, measured from the time the verification request was made from the hub to the subscriber. Hubs MUST supply this parameter for subscription requests. This parameter MAY be present for unsubscribe requests and MUST be ignored by subscribers during unsubscription.
+
hub.lease_seconds
+
REQUIRED/OPTIONAL. The hub-determined number of seconds that the subscription will stay active before expiring, measured from the time the verification request was made from the hub to the subscriber. Hubs MUST supply this parameter when hub.mode is set to "subscribe". This parameter MAY be present when hub.mode is "unsubscribe" and MUST be ignored by subscribers in that case.

Verification Details

@@ -576,7 +576,8 @@

Changes from 03 October 2017 PR to this version

  • Correct "mime-type" to "Media Type" and add informative reference to RFC.
  • Rephrase summary of "subscribing and unsubscribing" to explicitly mention the actor of each step
  • Clarify sending the POST request to the subscriber's callback URL
  • -
  • Add refence to HTTPS when previously only HTTP was mentioned in cases where an HTTPS URL may be used
  • +
  • Add reference to HTTPS when previously only HTTP was mentioned in cases where an HTTPS URL may be used
  • +
  • Clarify when hub.lease_seconds parameter is required or optional