<![CDATA[webfinger package for NodeJS]]>About 14 years ago, I created a webfinger package for NodeJS. At the time, NodeJS was only a few years old. I had created pump.io as a new social networking engine and the successor to StatusNet. I needed a client for webfinger lookup — the process of converting a user@domain.tld handle to a API endpoint for processing messages — and there wasn’t one for NodeJS, so I made it.

It is kind of an antique — very old callback-style code that has its own HTTP processing system. It supported the older version of Webfinger, RFC 6415, using XML for the data format. It also supported the (at that time) new Webfinger specification, RFC 7033.

Since its last release in 2013, version 0.4.2, I hadn’t touched the project. It’s just been languishing in the npm repository, squatting on the “webfinger” package name, and collecting dust. The Webfinger RFC was published, ActivityPub was standardized, and the Fediverse grew and grew, without a single change to the package.

I realized I was sitting on this package a couple of years, ago, and I’ve been wanting to get a new version out. This week, I just did it. I ripped out all the legacy support for RFC 6415, upgraded the tests to use the Node test runner, switched from callback style to async/await, changed to ESM modules, and changed the format to StandardJS.

I also added a little utility method, so it’s easier to look up links in the JRD file that is returned. Now, to get an ActivityPub actor, you just do this:

const types = [
  'application/activity+json',
  'application/ld+json; profile="https://www.w3.org/ns/activitystreams"&apos;
]
const actorId = (await webfinger('user1@foo.example')).link('self', types)?.href

I think the dependencies are low enough that you can use this version of the library from browser apps, although I haven’t tried it yet.

Anyway, I published version 0.5.1 today. I hope it provides some value to other people working on Fediverse software.

]]>https://citiverse.it/topic/87305f95-516f-4fee-a496-c4890dadb188/webfinger-package-for-nodejsRSS for NodeSat, 26 Sep 2026 02:34:31 GMTFri, 25 Sep 2026 18:20:25 GMT60<![CDATA[Reply to webfinger package for NodeJS on Fri, 25 Sep 2026 19:10:09 GMT]]>@evanprodromou@socialwebfoundation.org I was curious what your package does that mine doesn't, so I threw qwen at it. I've cut out much of the fluff, but the gist (feel free to skip it):

> ## What the package does that NodeBB doesn't
>
> - rel query parameter — passes rel to the server for server-side link filtering (NodeBB always fetches all links and filters client-side).
> - First-class aliases and properties accessors (NodeBB buries them in _raw).
> - link(rel, type) selector with exact media-type matching (NodeBB filters inline with assertAccept substring matching).
> - Frozen/immutable result objects.
> - Zero dependencies, native fetch.
>
> ## What NodeBB does that the package doesn't
>
> - Caching (positive 24h, negative 10min) + split-domain cache-bypass under strict.
> - 5s timeout.
> - Content-type validation with an application/octet-stream → JSON.parse fallback for non-compliant servers (package just calls res.json() and throws).
> - Subject handling: fixes missing acct:/did: scheme, extracts subjectHostname, computes splitDomain.
> - strict mode (rejects cross-domain subjects).
> - actorUri extraction (rel=self filtered by accepted ActivityPub types) and publicKey extraction.
> - false-on-failure semantics (callers do result || {...}).
> - Hostname round-trip validation (new URL('https://'+host)/ check) and cache-key normalization.
>
> ## Latent bug in the package
>
> It uses static URL.parse() for URL inputs — deprecated since Node 10 and slated for removal. It still works on this Node 23 build, but it's a ticking time-bomb on the Node versions it targets (22/24/26).

It reads like NodeBB's webfinger parsing is more battle-tested because I've had to handle funky webfinger responses from slightly out-of-spec servers.

There's potential for me to use your package as a low-level fetcher though.

]]>https://citiverse.it/post/https://activitypub.space/post/2489https://citiverse.it/post/https://activitypub.space/post/2489Fri, 25 Sep 2026 19:10:09 GMT