coracle/caravel
1
1
Fork 2
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(auth): document intentional session-style NIP-98 model #16

Merged
hodlbod merged 1 commits from userAdityaa/caravel:nip-docs into master 2026-04-16 15:40:50 +00:00
Conversation 0 Commits 1 Files Changed 5
+32 -6
userAdityaa commented 2026-04-16 08:54:59 +00:00
Contributor
Copy Link
Copy Source

Summary

This PR documents an intentional non-standard NIP-98 design choice for Caravel client-to-backend API authentication. The current behavior is signer-identity + host-affinity based, designed to reduce repeated signing prompts and avoid cookie-based sessions.

Context

Issue #12 raised strict NIP-98 request-intent concerns (exact URL/method/replay protections).
Maintainer clarified current behavior is intentional -> #12 (comment)

### Summary This PR documents an intentional non-standard NIP-98 design choice for Caravel client-to-backend API authentication. The current behavior is signer-identity + host-affinity based, designed to reduce repeated signing prompts and avoid cookie-based sessions. ### Context Issue #12 raised strict NIP-98 request-intent concerns (exact URL/method/replay protections). Maintainer clarified current behavior is intentional -> https://gitea.coracle.social/coracle/caravel/issues/12#issuecomment-2319
hodlbod added 1 commit 2026-04-16 15:40:42 +00:00
docs(auth): document intentional session-style NIP-98 model 0c75ac9ed5
hodlbod force-pushed nip-docs from 57e21cf51d to 0c75ac9ed5 2026-04-16 15:40:42 +00:00 Compare
hodlbod merged commit 145b511f9d into master 2026-04-16 15:40:50 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
hodlbod (hodlbod)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coracle/caravel#16
Delete Branch "userAdityaa/caravel:nip-docs"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?