GET /.well-known/atproto-did

AT Protocol (Bluesky) handle verification. A domain proves it owns a DID by returning the DID identifier in this file. Modes return malformed DIDs, multiple lines (spec says single), wrong DID methods, or empty content.

mode invalid-did-format (default; not in DID format), multiple-lines (two DIDs returned, spec says one), wrong-method (did:web pointing to a different domain than the one serving it), empty (no body at all).

build a request:

DID flaw

expect: 200 OK with Content-Type: text/plain. The default returns text that is not in DID format at all. Other modes return multiple DIDs, a did:web pointing elsewhere, or empty content. X-Chaos-Atproto-Did-Mode reflects the selection.

bash

curl -i 'https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format'

import urllib.request
resp = urllib.request.urlopen("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format")
print(resp.status, resp.headers["X-Chaos-Atproto-Did-Mode"])
print(repr(resp.read().decode()))

const res = await fetch("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format");
console.log(res.status, res.headers.get("x-chaos-atproto-did-mode"));
console.log(JSON.stringify(await res.text()));

package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    resp, _ := http.Get("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format")
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, resp.Header.Get("X-Chaos-Atproto-Did-Mode"))
    fmt.Printf("%q\n", string(body))
}

fn main() -> Result<(), Box> {
    let resp = reqwest::blocking::get("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format")?;
    println!("{} {:?}", resp.status(), resp.headers().get("x-chaos-atproto-did-mode"));
    println!("{:?}", resp.text()?);
    Ok(())
}

import java.net.URI;
import java.net.http.*;

public class BotsAtprotoDid {
    public static void main(String[] args) throws Exception {
        var client = HttpClient.newHttpClient();
        var req = HttpRequest.newBuilder(URI.create("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format")).build();
        var resp = client.send(req, HttpResponse.BodyHandlers.ofString());
        System.out.println(resp.statusCode() + " " +
            resp.headers().firstValue("X-Chaos-Atproto-Did-Mode").orElse(""));
        System.out.println(java.util.Objects.toString(resp.body()));
    }
}

using var client = new HttpClient();
var resp = await client.GetAsync("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format");
resp.Headers.TryGetValues("X-Chaos-Atproto-Did-Mode", out var mode);
Console.WriteLine($"{(int)resp.StatusCode} {mode?.FirstOrDefault()}");
Console.WriteLine($"{await resp.Content.ReadAsStringAsync()!}");

require "net/http"
res = Net::HTTP.get_response(URI("https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format"))
puts "#{res.code} #{res['X-Chaos-Atproto-Did-Mode']}"
puts res.body.inspect

$r = Invoke-WebRequest -Uri 'https://bots.catastrophic.io/.well-known/atproto-did?mode=invalid-did-format'
$r.Headers['X-Chaos-Atproto-Did-Mode']
$r.Content