client to server is severely impaired by "authorized fetch" because usually before building an Activity to send to an Actor's outbox, one would want to validate some of the IRIs they operate on.

For example, I want to build a Follow request for a remote actor (represented by an IRI or webfinger resource). My client won't allow me to add this random IRI as the Object of the Follow and just send it, it wants to dereference it and make sure it's a valid Actor.

However when authorized fetch is enabled on that actor's instance, this mechanism will fail, because the client can't generate a valid HTTP Signature for its request. :(

0

If you have a fediverse account, you can quote this note from your own instance. Search https://metalhead.club/users/mariusor/statuses/115587044357868033 on your instance and quote it. (Note that quoting is not supported in Mastodon.)