This morning, getting back to it by doing some testing.
Aaaand I broke HTTP signing.
This shits so fragile, I swear.
Ok, my approach this morning: Use the repl to make signed requests against Mastodon instances and see if I can puzzle together what's going on.
Mastodon helpfully returns the string used to actually produce the signature, so I'll start there.
So it turns out something in the stack is messing with the Connection header.
At the time the signature is produced, it's `Connection: close`
But what mastodon is seeing is `Connection: keep-alive`
Which breaks the signature.
I think I'm going to implement an allowlist of headers to consider.