Summary
Several issues were discovered when testing subdomain mode with solid.social:
- Container content negotiation - Container listings always returned JSON-LD even when
Accept: text/turtle was requested, causing mashlib parse errors
- Subdomain URL generation - Pod creation and registration generated path-based URLs instead of subdomain-based URLs when subdomain mode was enabled
- CORS DPoP header - The
DPoP header was not in the allowed CORS headers list, breaking Solid-OIDC authentication
- .ttl extension handling - Files with
.ttl extension were not served as Turtle format
Reproduction
- Enable subdomain mode in config
- Create a new account
- Visit the pod root (e.g.,
https://alice.example.com/)
- Mashlib fails with parse errors because container listings return JSON-LD when Turtle is requested
Fix
- Add content negotiation support for container listings without index.html
- Pass correct
podUri and issuer to createPodStructure in subdomain mode
- Add
DPoP to Access-Control-Allow-Headers
- Check URL extension for
.ttl files and serve Turtle regardless of Accept header
Files Changed
src/handlers/resource.js - Container conneg and .ttl extension handling
src/handlers/container.js - Pass podUri/issuer correctly
src/idp/interactions.js - Build subdomain URLs during registration
src/ldp/headers.js - Add DPoP to CORS headers
Summary
Several issues were discovered when testing subdomain mode with solid.social:
Accept: text/turtlewas requested, causing mashlib parse errorsDPoPheader was not in the allowed CORS headers list, breaking Solid-OIDC authentication.ttlextension were not served as Turtle formatReproduction
https://alice.example.com/)Fix
podUriandissuertocreatePodStructurein subdomain modeDPoPtoAccess-Control-Allow-Headers.ttlfiles and serve Turtle regardless of Accept headerFiles Changed
src/handlers/resource.js- Container conneg and .ttl extension handlingsrc/handlers/container.js- Pass podUri/issuer correctlysrc/idp/interactions.js- Build subdomain URLs during registrationsrc/ldp/headers.js- Add DPoP to CORS headers