// TODO: allow configuration of allowed target URI hosts.
private void processRequest(@NotNull HttpServletRequest req) throws BadRequestException {
		if (!EXPECTED_CONTENT_TYPE.isSameMimeType(ContentType.parse(req.getContentType()))) {
			throw new BadRequestException("Content type must be '%s'.".formatted(EXPECTED_CONTENT_TYPE.getMimeType()));
		}
		URI source = extractParameterAsUri(req, "source");
		URI target = extractParameterAsUri(req, "target");
		// Spec: 'The receiver MUST reject the request if the source URL is the same as the target URL.'
		if (source.equals(target)) {
			throw new BadRequestException("Source and target URL must not be identical.");
		}
		// TODO: allow configuration of allowed target URI hosts.
		LOGGER.debug("Received webmention submission request with source='{}' and target='{}'.", source, target);
		// TODO: perform check async
		/*
		 * Spec:
		 * 'If the receiver is going to use the Webmention in some way, (displaying it as a comment on a post,
		 * incrementing a "like" counter, notifying the author of a post), then it MUST perform an HTTP GET request
		 * on source [...] to confirm that it actually mentions the target.
		 */
		try {
			if (verificationService.isSubmissionValid(httpClient, source, target)) {
				LOGGER.debug("Webmention submission request with source='{}' and target='{}' passed verification.",
					source,
					target);
			} else {
				throw new BadRequestException("Source does not contain link to target URL.");
			}
		} catch (IOException e) {
			// In theory I/O failures cold also be issues on our side (e.g. trusted CAs being wrong), but
			// differentiating between those and issues on the source URIs side (e.g. 404s) seems hard.
			throw new BadRequestException("Verification of source URL could not be performed.", e);
		} catch (VerificationService.UnsupportedContentTypeException e) {
			throw new BadRequestException(
				"Verification of source URL failed due to no supported content type being served.",
				e);
		}
		handleSubmission(source, target);
	}
throw new BadRequestException("Source and target URL must not be identical.");
}
// TODO: allow configuration of allowed target URI hosts.
LOGGER.debug("Received webmention submission request with source='{}' and target='{}'.", source, target);
// TODO: perform check async
private void processRequest(@NotNull HttpServletRequest req) throws BadRequestException {
if (!EXPECTED_CONTENT_TYPE.isSameMimeType(ContentType.parse(req.getContentType()))) {
throw new BadRequestException("Content type must be '%s'.".formatted(EXPECTED_CONTENT_TYPE.getMimeType()));
}
URI source = extractParameterAsUri(req, "source");
URI target = extractParameterAsUri(req, "target");
// Spec: 'The receiver MUST reject the request if the source URL is the same as the target URL.'
if (source.equals(target)) {
throw new BadRequestException("Source and target URL must not be identical.");
}
// TODO: allow configuration of allowed target URI hosts.
LOGGER.debug("Received webmention submission request with source='{}' and target='{}'.", source, target);
// TODO: perform check async
/*
* Spec:
* 'If the receiver is going to use the Webmention in some way, (displaying it as a comment on a post,
* incrementing a "like" counter, notifying the author of a post), then it MUST perform an HTTP GET request
* on source [...] to confirm that it actually mentions the target.
*/
try {
if (verificationService.isSubmissionValid(httpClient, source, target)) {
private void processRequest(@NotNull HttpServletRequest req) throws BadRequestException {
if (!EXPECTED_CONTENT_TYPE.isSameMimeType(ContentType.parse(req.getContentType()))) {
throw new BadRequestException("Content type must be '%s'.".formatted(EXPECTED_CONTENT_TYPE.getMimeType()));
}
URI source = extractParameterAsUri(req, "source");
URI target = extractParameterAsUri(req, "target");
// Spec: 'The receiver MUST reject the request if the source URL is the same as the target URL.'
if (source.equals(target)) {
throw new BadRequestException("Source and target URL must not be identical.");
}
// TODO: allow configuration of allowed target URI hosts.
LOGGER.debug("Received webmention submission request with source='{}' and target='{}'.", source, target);
// TODO: perform check async
/*
* Spec:
* 'If the receiver is going to use the Webmention in some way, (displaying it as a comment on a post,
* incrementing a "like" counter, notifying the author of a post), then it MUST perform an HTTP GET request
* on source [...] to confirm that it actually mentions the target.
*/
try {
if (verificationService.isSubmissionValid(httpClient, source, target)) {
LOGGER.debug("Webmention submission request with source='{}' and target='{}' passed verification.",
source,
target);
} else {
throw new BadRequestException("Source does not contain link to target URL.");
}
} catch (IOException e) {
// In theory I/O failures cold also be issues on our side (e.g. trusted CAs being wrong), but
// differentiating between those and issues on the source URIs side (e.g. 404s) seems hard.
throw new BadRequestException("Verification of source URL could not be performed.", e);