├── robots.txt ├── .gitignore ├── errata ├── README.md └── index.php ├── github └── hook.php ├── implementation-reports ├── index.md ├── README.md ├── index.php ├── telegraph.md ├── falcon.md ├── franciscms.md ├── webmention.io.md ├── webmention.herokuapp.com.md ├── kaku.md ├── dobrado.md ├── known.md ├── processwire-webmention.md ├── gnusocial.md ├── postly.md ├── TEMPLATE.md ├── grav-plugin-webmention.md ├── bridgy.md └── summary │ └── index.html ├── README.md ├── implementations ├── index.php └── index.md ├── styles.css ├── index.php └── draft └── source └── index.html /robots.txt: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | -------------------------------------------------------------------------------- /errata/README.md: -------------------------------------------------------------------------------- 1 | Webmention Errata 2 | ================= 3 | 4 | No errata have been reported. 5 | 6 | -------------------------------------------------------------------------------- /errata/index.php: -------------------------------------------------------------------------------- 1 | &1'); 4 | echo 'ok'; 5 | -------------------------------------------------------------------------------- /implementation-reports/index.md: -------------------------------------------------------------------------------- 1 | # Webmention Implementation Reports 2 | 3 | * [Summary](https://webmention.net/implementation-reports/summary/) 4 | * [Reports](https://github.com/w3c/webmention/tree/master/implementation-reports) 5 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Webmention 2 | 3 | This repo contains the latest editor's draft of the [Webmention specification](http://webmention.net/draft/). 4 | 5 | Implementation reports are collected in the [Implementation Reports](implementation-reports) folder. 6 | 7 | [Webmention issues](https://github.com/aaronpk/webmention/issues) 8 | -------------------------------------------------------------------------------- /implementation-reports/README.md: -------------------------------------------------------------------------------- 1 | # Implementation Reports 2 | 3 | This folder is where you can find implementation reports that have been submitted. 4 | 5 | To submit your own, start with [TEMPLATE.md](TEMPLATE.md) 6 | 7 | View the [summary of submitted implementation reports](https://webmention.net/implementation-reports/summary/) 8 | -------------------------------------------------------------------------------- /implementations/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Webmention 5 | 6 | 11 | 12 | 13 | 14 |

15 | 22 |

23 | 24 | 25 | -------------------------------------------------------------------------------- /implementation-reports/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Webmention Implementation Reports 5 | 6 | 11 | 12 | 13 | 14 |

15 | 22 |

23 | 24 | 25 | -------------------------------------------------------------------------------- /styles.css: -------------------------------------------------------------------------------- 1 | body { 2 | background-color: #fefefe; 3 | font-family: "Helvetica Neue", Helvetica, sans-serif; 4 | font-size: 14pt; 5 | } 6 | .page { 7 | max-width: 500px; 8 | margin: 0 auto; 9 | } 10 | a { 11 | color: #78b35c; 12 | } 13 | a:hover { 14 | color: #93c57c; 15 | } 16 | h1 { 17 | text-align: center; 18 | } 19 | .subtitle { 20 | padding: 20px 30px; 21 | font-size: 16pt; 22 | background-color: #93c57c; 23 | border: 1px #78b35c solid; 24 | border-radius: 4px; 25 | } 26 | ul.links { 27 | margin: 0; 28 | margin-top: 20px; 29 | padding: 0; 30 | list-style-type: none; 31 | } 32 | ul.links li { 33 | margin: 0; 34 | padding: 0; 35 | padding-top: 16px; 36 | } 37 | ul.links .main { 38 | text-align: center; 39 | font-size: 18pt; 40 | padding-top: 26px; 41 | padding-bottom: 16px; 42 | } 43 | -------------------------------------------------------------------------------- /index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Webmention 5 | 6 | 7 | 8 | 9 |

10 | 11 |

Webmention

12 | 13 |

Webmention is a simple way to notify any URL when you link to it from your site.

14 | 15 |

The Webmention specification is being developed under the W3C Social Web Working Group.
Latest published version
Latest editor's draft
Implementations
The specification was contributed to the W3C by the IndieWeb community. More information and history of the spec can be found on the IndieWeb wiki.

22 | 23 |

24 | 25 | 26 | -------------------------------------------------------------------------------- /implementation-reports/telegraph.md: -------------------------------------------------------------------------------- 1 | # Telegraph 2 | 3 | Implementation Home Page URL: https://telegraph.p3k.io 4 | 5 | Source Code repo URL(s) (optional): https://github.com/aaronpk/Telegraph 6 | * [ ] 100% open source implementation 7 | 8 | Programming Language(s): PHP 9 | 10 | Developer(s): [Aaron Parecki](http://aaronparecki.com) 11 | 12 | Implementation Classes (Sender and/or Receiver): Sender 13 | 14 | 15 | ## Sending 16 | 17 | ### Discovery Tests (3.1.1) 18 | 19 | MUST 20 | 21 | * [x] [Discovery Test #1](https://webmention.rocks/test/1) 22 | * [x] [Discovery Test #2](https://webmention.rocks/test/2) 23 | * [x] [Discovery Test #3](https://webmention.rocks/test/3) 24 | * [x] [Discovery Test #4](https://webmention.rocks/test/4) 25 | * [x] [Discovery Test #5](https://webmention.rocks/test/5) 26 | * [x] [Discovery Test #6](https://webmention.rocks/test/6) 27 | * [x] [Discovery Test #7](https://webmention.rocks/test/7) 28 | * [x] [Discovery Test #8](https://webmention.rocks/test/8) 29 | * [x] [Discovery Test #9](https://webmention.rocks/test/9) 30 | * [x] [Discovery Test #10](https://webmention.rocks/test/10) 31 | * [x] [Discovery Test #11](https://webmention.rocks/test/11) 32 | * [x] [Discovery Test #12](https://webmention.rocks/test/12) 33 | * [x] [Discovery Test #13](https://webmention.rocks/test/13) 34 | * [x] [Discovery Test #14](https://webmention.rocks/test/14) 35 | * [x] [Discovery Test #15](https://webmention.rocks/test/15) 36 | * [x] [Discovery Test #16](https://webmention.rocks/test/16) 37 | * [x] [Discovery Test #17](https://webmention.rocks/test/17) 38 | * [x] [Discovery Test #18](https://webmention.rocks/test/18) 39 | * [x] [Discovery Test #19](https://webmention.rocks/test/19) 40 | * [x] [Discovery Test #20](https://webmention.rocks/test/20) 41 | * [x] [Discovery Test #21](https://webmention.rocks/test/21) 42 | 43 | 44 | ### Sending Tests (3.1.2) 45 | 46 | MUST 47 | 48 | * [x] Accepts HTTP 200 response as a success 49 | * [x] Accepts HTTP 201 response as a success 50 | * [x] Accepts HTTP 202 response as a success 51 | 52 | 53 | ### Update Tests (3.1.3) 54 | 55 | SHOULD 56 | 57 | * [x] [Update Test #1](https://webmention.rocks/update/1) 58 | * [ ] [Update Test #2](https://webmention.rocks/update/2) 59 | 60 | #### Implementation Notes 61 | 62 | Since Telegraph is an API, it depends on the calling website to update the post 63 | contents and trigger sending Webmentions when the post is updated. 64 | 65 | 66 | ### Delete Test (3.1.4) 67 | 68 | SHOULD 69 | 70 | * [ ] [Delete Test #1](https://webmention.rocks/delete/1) 71 | 72 | 73 | ### Security Considerations (4) 74 | 75 | * [ ] The sender avoids sending a Webmention to a loopback address (SHOULD) 76 | 77 | -------------------------------------------------------------------------------- /implementation-reports/falcon.md: -------------------------------------------------------------------------------- 1 | # Falcon 2 | 3 | Implementation Home Page URL: https://indieweb.org/Falcon 4 | 5 | Source Code repo URL(s) (optional): https://github.com/tantek/cassis https://github.com/indieweb/link-rel-parser-php/tree/master/src/IndieWeb 6 | * [ ] 100% open source implementation 7 | 8 | Programming Language(s): PHP 9 | 10 | Developer(s): [Tantek Çelik](http://tantek.com) 11 | 12 | Implementation Classes (Sender and/or Receiver): Sender 13 | 14 | 15 | ## Sending 16 | 17 | ### Discovery Tests (3.1.1) 18 | 19 | MUST 20 | 21 | * [x] [Discovery Test #1](https://webmention.rocks/test/1) 22 | * [x] [Discovery Test #2](https://webmention.rocks/test/2) 23 | * [x] [Discovery Test #3](https://webmention.rocks/test/3) 24 | * [x] [Discovery Test #4](https://webmention.rocks/test/4) 25 | * [x] [Discovery Test #5](https://webmention.rocks/test/5) 26 | * [x] [Discovery Test #6](https://webmention.rocks/test/6) 27 | * [x] [Discovery Test #7](https://webmention.rocks/test/7) 28 | * [x] [Discovery Test #8](https://webmention.rocks/test/8) 29 | * [x] [Discovery Test #9](https://webmention.rocks/test/9) 30 | * [x] [Discovery Test #10](https://webmention.rocks/test/10) 31 | * [x] [Discovery Test #11](https://webmention.rocks/test/11) 32 | * [x] [Discovery Test #12](https://webmention.rocks/test/12) 33 | * [x] [Discovery Test #13](https://webmention.rocks/test/13) 34 | * [x] [Discovery Test #14](https://webmention.rocks/test/14) 35 | * [x] [Discovery Test #15](https://webmention.rocks/test/15) 36 | * [x] [Discovery Test #16](https://webmention.rocks/test/16) 37 | * [x] [Discovery Test #17](https://webmention.rocks/test/17) 38 | * [x] [Discovery Test #18](https://webmention.rocks/test/18) 39 | * [x] [Discovery Test #19](https://webmention.rocks/test/19) 40 | * [x] [Discovery Test #20](https://webmention.rocks/test/20) 41 | * [x] [Discovery Test #21](https://webmention.rocks/test/21) 42 | 43 | #### Implementation Notes 44 | 45 | I wrote nearly all of the Webmention endpoint discovery code that Falcon uses as open source in the following two files: 46 | * https://github.com/indieweb/link-rel-parser-php/blob/master/src/IndieWeb/link_rel_parser.php — can be used for getting arbitrary link relationships from HTTP headers and HTML documents 47 | * https://github.com/indieweb/link-rel-parser-php/blob/master/src/IndieWeb/get_rel_webmention.php — uses the output of link_rel_parser.php functions to return a webmention endpoint and or a pingback endpoint if any 48 | 49 | 50 | ### Sending Tests (3.1.2) 51 | 52 | MUST 53 | 54 | * [x] Accepts HTTP 200 response as a success 55 | * [x] Accepts HTTP 201 response as a success 56 | * [x] Accepts HTTP 202 response as a success 57 | 58 | 59 | ### Update Tests (3.1.3) 60 | 61 | SHOULD 62 | 63 | * [ ] [Update Test #1](https://webmention.rocks/update/1) 64 | * [ ] [Update Test #2](https://webmention.rocks/update/2) 65 | 66 | #### Implementation Notes 67 | 68 | Update sending implementation in-progress. 69 | 70 | 71 | ### Delete Tests (3.1.4) 72 | 73 | SHOULD 74 | 75 | * [ ] [Delete Test #1](https://webmention.rocks/delete/1) 76 | 77 | #### Implementation Notes 78 | 79 | Delete sending implementation in-progress. 80 | 81 | 82 | ### Security Considerations (4) 83 | 84 | * [x] The sender avoids sending a Webmention to a loopback address (SHOULD) 85 | 86 | 87 | ### Extensions 88 | 89 | This implementation has also implemented the following extensions. 90 | 91 | * [ ] [Salmention](http://indiewebcamp.com/Salmention) 92 | * [ ] [Vouch](http://indiewebcamp.com/Vouch) 93 | * [ ] Other: _______ 94 | -------------------------------------------------------------------------------- /implementation-reports/franciscms.md: -------------------------------------------------------------------------------- 1 | # FrancisCMS 2 | 3 | Implementation Home Page URL: https://github.com/FrancisCMS/FrancisCMS 4 | 5 | Source Code repo URL(s) (optional): 6 | * [x] 100% open source implementation 7 | 8 | Programming Language(s): Ruby 9 | 10 | Developer(s): [Jason Garber](https://sixtwothree.org/) 11 | 12 | Implementation Classes (Sender and/or Receiver): 13 | 14 | 15 | ## Receiving 16 | 17 | Indicate which type of response the receiver provides: 18 | 19 | * [ ] HTTP 200 - Receiver synchronously processes the Webmention request (not recommended) 20 | * [ ] HTTP 201 - Receiver creates a status URL the sender can use to check the status of the Webmention 21 | * [x] HTTP 202 - Receiver processes the Webmention asynchronously 22 | 23 | Describe the response body (if any) which is returned in the request: 24 | 25 | The response body contains the URL to the webmention in the form of https://example.com/webmentions/1. 26 | 27 | 28 | ### Request Verification (3.2.1) 29 | 30 | * [x] Verifies source and target are valid URLs, rejecting with HTTP 400 (MUST) 31 | * [x] Verifies that target is a valid resource for which the receiver accepts Webmentions, rejecting with HTTP 400 (SHOULD) 32 | * [x] Ignores fragment when checking if target is supported (SHOULD) 33 | 34 | ### Webmention Verification (3.2.2) 35 | 36 | * [x] Verification is processed asynchronously (SHOULD) 37 | * [x] Follows at least one HTTP redirect on source URL (MUST) 38 | * [x] Respects a self-imposed limit on number of HTTP redirects to follow (MUST) 39 | 40 | #### Source URL content-types supported 41 | 42 | Please list the content types that your implementation supports when checking if the source document links to the target URL. 43 | 44 | * [x] HTML 45 | * [ ] Other: ______ 46 | 47 | 48 | ### HTML Verification (3.2.3) 49 | 50 | The tests below apply when the source document is HTML. 51 | 52 | * [x] Accepts a Webmention where the target URL is in an `` tag 53 | * [ ] Accepts a Webmention where the target URL is in an `` tag 54 | * [ ] Accepts a Webmention where the target URL is in an `

` tag inside an HTML comment 129 | * [x] Rejects a Webmention where the target URL is not in the document 130 | 131 | 132 | ### Webmention Display/Use 133 | 134 | * [x] The receiver displays data from the source URL on the target post (MAY) 135 | 136 | * [x] The receiver recognizes that the source URL is a "comment" or "reply" to the post 137 | * [x] using HTML markup: class="u-in-reply-to" 138 | * [x] The receiver recognizes that the source URL is a "like" of the post 139 | * [x] using HTML markup: class="u-like-of" or class="u-like" 140 | * [x] The receiver recognizes that the source URL is a "repost" of the post 141 | * [x] using HTML markup: class="u-repost-of" or class="u-repost" 142 | * [ ] The receiver recognizes that the source URL is an "RSVP" to the post 143 | * [ ] using HTML markup: __________ 144 | * [x] The receiver recognizes additional response types, using markup: 145 | * [x] Response: tag using HTML markup: class="u-tag-of" 146 | * (Please add lines like above for additional response types the receiver has implemented) 147 | 148 | Please describe any other ways the Webmention is displayed or used if applicable. 149 | 150 | Webmentions are only displayed if parsable microformats and are a comment, reply, like, repost, 151 | otherwise stored and not displayed. 152 | 153 | 154 | ### Update Tests (3.2.4) 155 | 156 | * [x] Does not display an update Webmention as a new response (SHOULD) 157 | * [x] Removes the response when an update Webmention is sent and the source URL returns 200 and no link is found (SHOULD) 158 | * [x] Updates and stores the information from the primary object at the source URL (MUST) 159 | * [x] Updates and stores the information from children or descendant objects at the source URL (MAY) 160 | 161 | 162 | ### Delete Tests (3.2.4) 163 | 164 | * [x] Recognizes an HTTP 410 response as a delete, and removes the response (SHOULD) 165 | 166 | 167 | ### Security Considerations (4) 168 | 169 | * [x] Webmentions are moderated before being displayed (MAY) 170 | * [ ] Webmentions are periodically re-verified (MAY) 171 | * [x] The receiver ensures any displayed data it properly encoded/filtered to prevent XSS attacks (MUST) 172 | * [x] Respects a self-imposed limit on the time spent fetching the source URL (SHOULD) 173 | * [ ] Respects a self-imposed limit on the number of bytes fetched from the source URL (SHOULD) 174 | * [ ] The receiver accepts additional parameters or headers, and so has CSRF protection (SHOULD) 175 | 176 | #### Implementation Notes 177 | 178 | Webmentions coming from un-vouched or non-whitelisted domains are moderated 179 | 180 | 181 | 182 | ### Extensions 183 | 184 | This implementation has also implemented the following extensions. 185 | 186 | * [x] [Salmention](http://indiewebcamp.com/Salmention) 187 | * [x] [Vouch](http://indiewebcamp.com/Vouch) 188 | * [ ] Other: _______ 189 | 190 | -------------------------------------------------------------------------------- /implementation-reports/TEMPLATE.md: -------------------------------------------------------------------------------- 1 | This file is a sample implementation report. Fork this repository, copy this file to a new `.md` file and change the name to your project name (in lower case with hyphens between words), and fill out the information in the report based on your implementation. When you are finished, submit a pull request and your report will be reviewed and added to the main repository. 2 | 3 | Complete this report by filling out the checkboxes as appropriate. To mark one as successful/complete/true, add an `x` between the brackets, e.g. `[x]`. If the statement does not apply to your implementation, use `[na]` and add a sentence explaining why it does not apply. 4 | 5 | If your implementation is only a sender or only a receiver, remove the other section from the document before submitting. 6 | 7 | When you are complete, send a pull request with the addition of your report file. Please remove this entire top section before submitting. 8 | 9 | 10 | # Implementation Name (Replace this header) 11 | 12 | Implementation Home Page URL: 13 | 14 | Source Code repo URL(s) (optional): 15 | * [ ] 100% open source implementation 16 | 17 | Programming Language(s): 18 | 19 | Developer(s): [Name](http://you.example.com) 20 | 21 | Implementation Classes (Sender and/or Receiver): 22 | 23 | 24 | ## Sending 25 | 26 | ### Discovery Tests (3.1.1) 27 | 28 | MUST 29 | 30 | * [ ] [Discovery Test #1](https://webmention.rocks/test/1) 31 | * [ ] [Discovery Test #2](https://webmention.rocks/test/2) 32 | * [ ] [Discovery Test #3](https://webmention.rocks/test/3) 33 | * [ ] [Discovery Test #4](https://webmention.rocks/test/4) 34 | * [ ] [Discovery Test #5](https://webmention.rocks/test/5) 35 | * [ ] [Discovery Test #6](https://webmention.rocks/test/6) 36 | * [ ] [Discovery Test #7](https://webmention.rocks/test/7) 37 | * [ ] [Discovery Test #8](https://webmention.rocks/test/8) 38 | * [ ] [Discovery Test #9](https://webmention.rocks/test/9) 39 | * [ ] [Discovery Test #10](https://webmention.rocks/test/10) 40 | * [ ] [Discovery Test #11](https://webmention.rocks/test/11) 41 | * [ ] [Discovery Test #12](https://webmention.rocks/test/12) 42 | * [ ] [Discovery Test #13](https://webmention.rocks/test/13) 43 | * [ ] [Discovery Test #14](https://webmention.rocks/test/14) 44 | * [ ] [Discovery Test #15](https://webmention.rocks/test/15) 45 | * [ ] [Discovery Test #16](https://webmention.rocks/test/16) 46 | * [ ] [Discovery Test #17](https://webmention.rocks/test/17) 47 | * [ ] [Discovery Test #18](https://webmention.rocks/test/18) 48 | * [ ] [Discovery Test #19](https://webmention.rocks/test/19) 49 | * [ ] [Discovery Test #20](https://webmention.rocks/test/20) 50 | * [ ] [Discovery Test #21](https://webmention.rocks/test/21) 51 | 52 | #### Implementation Notes 53 | 54 | (Add implementation notes here, or remove this section) 55 | 56 | 57 | ### Sending Tests (3.1.2) 58 | 59 | MUST 60 | 61 | * [ ] Accepts HTTP 200 response as a success 62 | * [ ] Accepts HTTP 201 response as a success 63 | * [ ] Accepts HTTP 202 response as a success 64 | 65 | 66 | ### Update Tests (3.1.3) 67 | 68 | SHOULD 69 | 70 | * [ ] [Update Test #1](https://webmention.rocks/update/1) 71 | * [ ] [Update Test #2](https://webmention.rocks/update/2) 72 | 73 | #### Implementation Notes 74 | 75 | (Add implementation notes here, or remove this section) 76 | 77 | 78 | ### Delete Tests (3.1.4) 79 | 80 | SHOULD 81 | 82 | * [ ] [Delete Test #1](https://webmention.rocks/delete/1) 83 | 84 | #### Implementation Notes 85 | 86 | (Add implementation notes here, or remove this section) 87 | 88 | 89 | ### Security Considerations (4) 90 | 91 | * [ ] The sender avoids sending a Webmention to a loopback address (SHOULD) 92 | 93 | 94 | ### Extensions 95 | 96 | This implementation has also implemented the following extensions. 97 | 98 | * [ ] [Salmention](http://indiewebcamp.com/Salmention) 99 | * [ ] [Vouch](http://indiewebcamp.com/Vouch) 100 | * [ ] Other: _______ 101 | 102 | 103 | ## Receiving 104 | 105 | Indicate which type of response the receiver provides: 106 | 107 | * [ ] HTTP 200 - Receiver synchronously processes the Webmention request (not recommended) 108 | * [ ] HTTP 201 - Receiver creates a status URL the sender can use to check the status of the Webmention 109 | * [ ] HTTP 202 - Receiver processes the Webmention asynchronously 110 | 111 | Describe the response body (if any) which is returned in the request: 112 | 113 | 114 | ### Request Verification (3.2.1) 115 | 116 | * [ ] Verifies source and target are valid URLs, rejecting with HTTP 400 (MUST) 117 | * [ ] Verifies that target is a valid resource for which the receiver accepts Webmentions, rejecting with HTTP 400 (SHOULD) 118 | * [ ] Ignores fragment when checking if target is supported (SHOULD) 119 | 120 | ### Webmention Verification (3.2.2) 121 | 122 | * [ ] Verification is processed asynchronously (SHOULD) 123 | * [ ] Follows at least one HTTP redirect on source URL (MUST) 124 | * [ ] Respects a self-imposed limit on number of HTTP redirects to follow (MUST) 125 | 126 | #### Source URL content-types supported 127 | 128 | Please list the content types that your implementation supports when checking if the source document links to the target URL. 129 | 130 | * [ ] HTML 131 | * [ ] Other: ______ 132 | 133 | 134 | ### HTML Verification (3.2.2) 135 | 136 | The tests below apply when the source document is HTML. 137 | 138 | * [ ] Accepts a Webmention where the target URL is in an `` tag 139 | * [ ] Accepts a Webmention where the target URL is in an `` tag 140 | * [ ] Accepts a Webmention where the target URL is in an `

124 |

125 | Webmention is a simple way to notify any URL when you mention it on your site. From the receiver's perspective, it's a way to request notifications when other sites mention it. 126 |

127 | 128 |

129 |

Author's Note

130 |

This specification was contributed to the W3C from the 131 | IndieWeb community. More 132 | history and evolution of Webmention can be found on the 133 | IndieWeb wiki.

134 |

135 |

136 | 137 |

138 |

139 | 140 |

141 |

Introduction

142 | 143 |

A Webmention is a notification that one URL links to another. For example, Alice writes an interesting post on her blog. Bob then writes a response to her post on his own site, linking back to Alice's original post. Bob's publishing software sends a Webmention to Alice notifying that her article was replied to, and Alice's software can show that reply as a comment on the original post.

144 | 145 |

Sending a Webmention is not limited to blog posts, and can be used for additional kinds of content and responses as well. For example, a response can be an RSVP to an event, an indication that someone "likes" another post, a "bookmark" of another post, and many others. Webmention enables these interactions to happen across different websites, enabling a distributed social web.

146 | 147 |

148 |

Social Web Working Group

149 | 150 |

Webmention is one of several related specifications being produced by the Social Web Working Group. Implementers interested in alternative approaches and complimentary protocols should start by reading the overview document [[social-web-protocols]].

151 |

152 | 153 |

154 |

Overview

155 | 156 |

A typical Webmention flow is as follows: 157 |

Alice posts some interesting content on her site (which is set up to receive Webmentions).
Bob sees this content and comments about it on his site, linking back to Alice's original post.
Using Webmention, Bob's publishing software automatically notifies Alice's server that her post has been linked to by the URL of Bob's post.
Alice's publishing software verifies that Bob's post actually contains a mention of her post and then includes this information on her site.

163 |

164 |

165 | 166 |

167 |

Protocol Summary

168 | 169 |

Webmentions are sent "from" a source URL "to" a target URL to notify the target that it has been mentioned at the source URL.

170 | 171 |

User Aaron writes a post on his blog.
User Barnaby writes a post on his blog that links to Aaron's post.
After publishing the post (i.e., after it has a URL), Barnaby's server notices the mention of Aaron's post as part of the publishing process.
Barnaby's server does Webmention discovery on Aaron's post to find its Webmention endpoint (if not found, process stops).
Barnaby's server sends a Webmention notification to Aaron's post's Webmention endpoint with: 177 |
- source set to Barnaby's post's permalink
- target set to Aaron's post's permalink.
181 |
Aaron's server receives the Webmention.
Aaron's server verifies that target in the Webmention is a valid permalink on Aaron's blog (if not, processing stops).
Aaron's server verifies that the source in the Webmention (when retrieved, after following redirects [[!FETCH]]) contains a hyperlink to the target (if not, processing stops).

186 | 187 |

188 |

189 | 190 |

191 |

Conformance

192 | 193 |

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 194 | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 195 | document are to be interpreted as described in [[!RFC2119]].

196 | 197 |

198 |

Conformance Classes

199 | 200 |

Webmention implementations are either senders or receivers. This section describes the conformance criteria for both.

201 | 202 |

Listed below are known types of Webmention implementations.

203 | 204 |

Senders

205 |

The conformance criteria for Webmention senders is described in Sending Webmentions

206 |

Blogging or microblogging software
Plugins for existing CMS software
Browser plugins to send a Webmention from a context menu on behalf of the page you're viewing
Web APIs to offload the Webmention endpoint discovery and Webmention delivery
Proxy services that converts existing social media posts to HTML posts and sends Webmentions

213 | 214 |

Receivers

215 |

The conformance criteria for Webmention receivers is described in Receiving Webmentions

216 |

Blogging or microblogging software
Plugins for existing CMS software
Web services and APIs to receive Webmentions and display them as comments via Javascript embed

221 |

222 | 223 |

224 |

Candidate Recommendation Exit Criteria

225 | 226 |

For this specification to exit the CR stage, there must be at least two independent, interoperable implementations of each feature. Each feature may be implemented by a different set of products. There is no requirement that all features be implemented by a single product. For the purposes of this criterion, we define the following terms:

227 | 228 |

229 |

Sender

230 | 231 |

A Webmention Sender is an implementation that sends Webmentions, the conformance criteria are described in Sending Webmentions. In order for a Sender to send a Webmention, there must first be a document at a URL that is accessible to the Receiver.

232 |

233 | 234 |

235 |

Receiver

236 | 237 |

A Webmention Receiver is an implementation that receives Webmentions to one or more target URLs on which the Receiver's Webmention endpoint is advertised. The conformance criteria for Receivers are described in Receiving Webmentions. In order to receive a Webmention, there must be a URL that advertises the Receiver's Webmention endpoint. The URL is not considered part of the Receiver's implementation, as it may exist in an entirely different system or domain.

238 |

239 | 240 |

241 |

Independent

242 | 243 |

Each implementation must be developed by a different party and cannot share, reuse, or derive from code used by another qualifying implementation. Sections of code that have no bearing on the implementation of this specification are exempt from this requirement.

244 |

245 | 246 |

247 |

Interoperable

248 | 249 |

A Sender and Receiver implementation are considered interoperable for a specific feature when the Sender 1) can discover the Webmention endpoint for the target URL for all specified ways of finding the endpoint (allowing the Receiver to change the way the endpoint is advertised without changing the Sender implementation), and 2) considers the Webmention request successful for all specified ways a Receiver may indicate success.

250 |

251 | 252 |

253 |

Implementation

254 | 255 |

An Implementation is a Webmention Sender or Receiver which meets all of the following criteria:

256 | 257 |

implements the corresponding conformance class of the specification
is available to the general public, as downloadable software or as a hosted service
is not experimental (i.e. is intended for a wide audience and could be used on a daily basis)
is suitable for a person to use as his/her primary implementation on a website

263 |

264 | 265 |

266 |

Feature

267 | 268 |

For the purposes of evaluating exit criteria, each of the following is considered a feature:

269 | 270 |

Sending a Webmention to a given target URL
Re-sending Webmentions and sending new Webmentions when the source document is updated
Re-sending Webmentions when the source document is deleted
Receiving a Webmention request, processing it synchronously, and responding with HTTP 200
Receiving a Webmention request, processing it asynchronously, creating a status URL and responding with HTTP 201
Receiving a Webmention request, processing it asynchronously, and responding with HTTP 202 and no other feedback
Updates: Receiving a Webmention from a source URL that was previously seen and updating the data it picked up from the source URL
Delete: Receiving a Webmention from a source URL which now responds with HTTP 410

280 |

281 | 282 |

283 | 284 |

285 |

Test Suite and Reporting

286 | 287 |

Please submit your implementation reports at http://webmention.net/implementation-reports/. Instructions are provided at the URL. The implementation report template references the tests available at webmention.rocks.

288 | 289 |

webmention.rocks provides many test cases you can use to live-test your implementation. It also is a good tool to use while developing a Webmention implementation, as it provides detailed responses when errors are encountered.

290 |

291 |

292 | 293 |

294 |

Webmention Protocol

295 | 296 |

This specification uses the link rel registry as defined by [[!HTML5]] 297 | for both HTML and HTTP link relations.

298 | 299 |

300 |

Sending Webmentions

301 | 302 |

303 |

Create a source document that mentions the target

304 | 305 |

Webmentions are sent "from" a source URL "to" a target URL to notify the target that it has been mentioned at the source URL. Before a Webmention can be sent, there needs to be a source URL to send the Webmention "from", often a blog post but may be any type of content.

306 | 307 |

For example, the URL at https://waterpigs.example/post-by-barnaby may contain the following HTML that has a link to Aaron's post.

308 |

<!doctype html>
309 | <html>
310 |   <body>
311 |     <a href="https://aaronpk.example/post-by-aaron">This is a great post</a>
312 |   </body>
313 | </html>
314 |

315 |

316 | 317 |

318 |

Sender discovers receiver Webmention endpoint

319 | 320 |

The sender MUST fetch the target URL (and follow redirects [[!FETCH]]) 321 | and check for an HTTP Link header [[!RFC5988]] 322 | with a rel value of webmention. If the content type of the document 323 | is HTML, then the sender MUST look for an HTML <link> and 324 | <a> element with a rel value of webmention. If more than 325 | one of these is present, the first HTTP Link header takes precedence, 326 | followed by the first <link> or <a> 327 | element in document order. Senders MUST support all 328 | three options and fall back in this order.

329 | 330 |

The endpoint MAY be a relative 331 | URL, in which case the sender MUST resolve it relative to the 332 | target URL according to [[!URL]].

333 | 334 |

The endpoint MAY contain query string parameters, which MUST be 335 | preserved as query string parameters and MUST NOT be sent as POST body 336 | parameters when sending the Webmention request.

337 | 338 |

Senders MAY initially make an HTTP HEAD request [[!RFC7231]] to 339 | check for the Link header before making a GET request.

340 | 341 |

GET /post-by-aaron HTTP/1.1
342 | Host: aaronpk.example
343 | HTTP/1.1 200 OK
344 | Link: <http://aaronpk.example/webmention-endpoint>; rel="webmention"
345 | 
346 | <html>
347 | <head>
348 | ...
349 | <link href="http://aaronpk.example/webmention-endpoint" rel="webmention" />
350 | ...
351 | </head>
352 | <body>
353 | ....
354 | <a href="http://aaronpk.example/webmention-endpoint" rel="webmention">webmention</a>
355 | ...
356 | </body>
357 | </html>

358 | 359 |

Senders MAY customize the HTTP User Agent [[RFC7231]] used when fetching the target URL 360 | in order to indicate to the recipient that this request is made as part of Webmention discovery. 361 | In this case, it is recommended to include the string "Webmention" in the User Agent. This 362 | provides people with a pointer to find out why the discovery request was made.

363 | 364 |

365 |

366 |

Sender notifies receiver

367 | 368 |

The sender MUST post x-www-form-urlencoded [[!HTML5]] source and 369 | target parameters to the Webmention endpoint, where 370 | source is the URL of the sender's page containing a link, 371 | and target is the URL of the page being linked to.

372 | 373 |

Note that if the Webmention endpoint URL contains query string parameters, 374 | the query string parameters MUST be preserved, and MUST NOT be sent in the 375 | POST body.

376 | 377 |

The Webmention endpoint will validate and process the request, and 378 | return an HTTP status code [[!RFC7231]]. Most often, 202 Accepted 379 | or 201 Created will be returned, indicating that the 380 | request is queued and being processed asynchronously to prevent 381 | DoS attacks. If the response code is 201, the Location 382 | header will include a URL that can be used to monitor the 383 | status of the request.

384 | 385 |

Any 2xx response code MUST be considered a success.

386 | 387 |

POST /webmention-endpoint HTTP/1.1
388 | Host: aaronpk.example
389 | Content-Type: application/x-www-form-urlencoded
390 | 
391 | source=https://waterpigs.example/post-by-barnaby&
392 | target=https://aaronpk.example/post-by-aaron
393 | 
394 | 
395 | HTTP/1.1 202 Accepted

396 | 397 |

398 |

399 |

Sending Webmentions for updated posts

400 | 401 |

If the source URL was updated, the sender SHOULD re-send any previously sent Webmentions, 402 | (including re-sending a Webmention to a URL that may have been removed from the document), 403 | and SHOULD send Webmentions for any new links that appear at the URL.

404 | 405 |

This allows the recipients of Webmentions to update their display of the source document, 406 | or otherwise notify the recipient that a post that mentioned one of their URLs was updated.

407 | 408 |

When sending a Webmention when a post is updated, the sender MUST re-discover the Webmention endpoint of each target URL, in case the target has updated their Webmention endpoint.

409 | 410 |

If a response to the source URL is shown on the source URL page (e.g. as a comment), then sender SHOULD treat that as an update of the source URL and re-send any previously sent Webmentions.

411 |

412 |

413 |

Sending Webmentions for deleted posts

414 | 415 |

If the source URL was deleted, the sender SHOULD return an HTTP 410 Gone 416 | status code for the URL, and SHOULD display a "tombstone" representation of 417 | the deleted post, typically by blanking out the values of any properties in the post, and/or 418 | replacing the primary content of the post (e.g. the name and/or content of [[h-entry]]) 419 | with "Deleted". The sender SHOULD then re-send Webmentions for every previously sent 420 | Webmention for that document.

421 | 422 |

This allows receivers which may have displayed a previously received Webmention 423 | as a comment or other interaction to remove it from view if they support deletes, while 424 | providing a reasonable fallback for receivers which only support updates.

425 |

426 |

427 | 428 |

429 |

Receiving Webmentions

430 | 431 |

Upon receipt of a POST request containing the source and 432 | target parameters, the receiver SHOULD verify the parameters 433 | (see Request Verification below) and then 434 | SHOULD queue and process the request asynchronously, prevent DoS attacks. 435 | There are three possible responses to the request, depending on how the receiver 436 | processes it.

437 | 438 |

If the receiver creates a status page which the sender can use to 439 | check the status, the receiver MUST reply with an HTTP 201 Created 440 | response with a Location header pointing to the status 441 | URL. The response body MAY contain content.

442 | 443 |

HTTP/1.1 201 Created
444 | Location: http://aaronpk.example/webmention/DEhB9Jme

445 | 446 |

If the receiver processes the request asynchronously but does not 447 | return a status URL, the receiver MUST reply with an HTTP 202 Accepted 448 | response. The response body MAY contain content, in which case a 449 | human-readable response is recommended.

450 | 451 |

HTTP/1.1 202 Accepted

452 | 453 |

If the receiver chooses to process the request and perform the 454 | verification step synchronously (not recommended), it MUST respond 455 | with a 200 OK status on success.

456 | 457 |

458 |

Request Verification

459 | 460 |

The receiver MUST check that source and target are valid URLs [[!URL]] 461 | and are of schemes that are supported by the receiver. (Most 462 | commonly this means checking that the source and target 463 | schemes are http or https).

464 | 465 |

The receiver MUST reject the request if the source URL is the same as the target URL.

466 | 467 |

The receiver SHOULD check that target is a valid resource for which 468 | it can accept Webmentions. This check SHOULD happen 469 | synchronously to reject invalid Webmentions before more in-depth 470 | verification begins. What a 'valid resource' means is up to the receiver. For example, 471 | some receivers may accept Webmentions for multiple domains, others may accept 472 | Webmentions for only the same domain the endpoint is on.

473 | 474 |

Note that a target URL may contain a fragment identifier, and if the 475 | receiver limits which URLs can receive Webmentions, the fragment SHOULD be 476 | ignored when checking if the URL is supported.

477 |

478 | 479 |

480 |

Webmention Verification

481 | 482 |

Webmention verification SHOULD be handled asynchronously to 483 | prevent DoS attacks.

484 | 485 |

If the receiver is going to use the Webmention in some way, 486 | (displaying it as a comment on a post, incrementing a "like" 487 | counter, notifying the author of a post), then it MUST perform an 488 | HTTP GET request on source, following any HTTP redirects (and SHOULD 489 | limit the number of redirects it follows) to confirm that it actually 490 | mentions the target. The receiver SHOULD include an HTTP Accept header 491 | indicating its preference of content types that are acceptable.

492 | 493 |

The receiver SHOULD use per-media-type rules to determine whether 494 | the source document mentions the target URL. For example, in an 495 | [[HTML5]] document, the receiver should look for <a href="*">, 496 | <img href="*">, <video src="*"> 497 | and other similar links. In a [[JSON]] document, the receiver should 498 | look for properties whose values are an exact match for the URL. 499 | If the document is plain text, the receiver should look for the URL 500 | by searching for the string. Other content types may be handled at 501 | the implementer's discretion. The source document MUST have an exact 502 | match of the target URL provided in order for it to be considered a 503 | valid Webmention.

504 | 505 |

At this point, the receiver MAY publish content from the source page 506 | on the target page or other pages, along with any other data it picks 507 | up from the source. For example, the receiver may display the 508 | contents of the source as a comment on the post, or may display the author's 509 | profile photo in a list of others who have sent similar Webmentions, e.g. 510 | showing a list of people who have all "liked" a post.

511 |

512 | 513 |

514 |

Error Responses

515 | 516 |

If the Webmention was not successful because of something the 517 | sender did, it MUST return a 400 Bad Request 518 | status code and MAY include a description of the error in the response body.

519 | 520 |

Possible sender-related errors that can be returned synchronously 521 | before making a GET request to the source: 522 | 523 |

Specified target URL not found.
Specified target URL does not accept Webmentions.
source URL was malformed or is not a supported URL scheme (e.g. a mailto: link)

528 |

529 | 530 |

Possible sender-related errors that can occur after fetching the 531 | contents of the source URL: 532 | 533 |

source URL not found.
source URL does not contain a link to the target URL.

537 |

538 | 539 |

If the Webmention was not successful because of an error on 540 | the receiver's server, it SHOULD return a 500 Internal Server Error 541 | status code and MAY include a description of the error in the response body.

542 | 543 |

544 | 545 |

546 |

Updating existing Webmentions

547 | 548 |

If receiver had received a Webmention in the past with the same 549 | source and target then, 550 | 551 |

553 | If both the verification steps are successful, it SHOULD update any existing data it picked from source for the existing Webmention. 554 |
- 556 | When a Webmention implementation does support updating (i.e., a "Webmention update implementation"), it MUST support updating data from properties of the primary object of the source. (e.g. properties of the [[h-entry]] of the page). 557 |
  - 559 | A Webmention update implementation MAY support updating data from children, or other descendant objects of the primary object (e.g. a comment h-entry inside the h-entry of the page). Note: Implementations that support this may wish to consider supporting it according to the [[Salmention]] extension. 560 |
  562 |
564 |
If it received a 410 Gone status code on step 2 (performing a GET request on source), or received a 200 OK status code and does not find a mention of target on source, it SHOULD delete the existing Webmention, or mark it as deleted.
Processing Webmentions SHOULD be idempotent. That is, receiving multiple Webmentions for the same source and target with no content changes should not show as multiple replies.

570 |

571 |

572 | 573 |

574 |

575 | 576 |

577 |

Security Considerations

578 | 579 |

580 |

Preventing Abuse

581 | 582 |

The verification process SHOULD be queued and processed asynchronously to prevent DoS attacks.
Receivers MAY moderate Webmentions before displaying them.
Receivers MAY periodically re-verify Webmentions and update them.
If a receiver chooses to publish data it picks up from source, it MUST ensure that the data is encoded and/or filtered to prevent XSS and CSRF attacks.

588 |

589 | 590 |

591 |

Limits on GET requests

592 | 593 |

The Webmention protocol relies on the sender making a GET (or HEAD) 594 | request to discover the receiver's endpoint, followed by the receiver 595 | making a GET request to the sender's web page to verify the link. 596 | This means a sender can cause a receiver to make GET requests to 597 | arbitrary URLs, opening up a potential DoS vector.

598 |

Receivers MAY make an initial HTTP HEAD request when verifying the link 599 | and decide whether to make a full GET request after initially inspecting 600 | the content type, length, or other HTTP headers returned.

601 |

Receivers SHOULD place limits on the number of HTTP redirects they follow, 602 | for example limiting the number to 20, in order to prevent being stuck 603 | in a redirect loop if the sender continues to send redirects.

604 |

Receivers SHOULD place limits on the amount of data and time they 605 | spend fetching unverified source URLs. For example, if a source URL 606 | doesn't respond within 5 seconds, it can treat that as a failure. 607 | Similarly, the receiver can fetch only the first 1mb of the page, 608 | since any reasonable HTML or JSON page will be smaller than that.

609 |

610 | 611 |

612 |

Avoid sending Webmentions to localhost

613 | 614 |

When the sender discovers the receiver's Webmention endpoint, there 615 | is no legitimate reason for the endpoint to be localhost or any other loopback 616 | address. If the sender has any services that listen on localhost that 617 | don't require authentication, it's possible for a malicious Webmention 618 | receiver to craft a Webmention endpoint that could cause the sender to 619 | make an arbitrary POST request to itself.

620 |

During the discovery step, if the sender discovers the endpoint is 621 | localhost or a loopback IP address (127.0.0.0/8), it SHOULD NOT send 622 | the Webmention.

623 |

624 | 625 |

626 |

Cross-Site Request Forgery

627 | 628 |

This specification does not define any special handling of a Webmention request 629 | that may contain additional headers or parameters such as authentication headers 630 | or session cookies. However, if a Webmention endpoint does accept requests 631 | with additional headers, it SHOULD protect itself against Cross-Site 632 | Request Forgery (CSRF) attacks. One way to prevent CSRF attacks is by including 633 | a CSRF token in a query string parameter of the Webmention endpoint, so that 634 | a Webmention sender finds the token when discovering the endpoint.

635 | 636 |

For example, the target URL could advertise a Webmention endpoint that includes 637 | a CSRF token:

638 | 639 |

GET /post-by-aaron HTTP/1.1
640 | Host: aaronpk.example
641 | HTTP/1.1 200 OK
642 | Link: <http://aaronpk.example/webmention?csrf=Q0NTVhYjI0NTVkNDA3M>; rel="webmention"

643 | 644 |

Then, when the Webmention endpoint is processing a request, it can first check 645 | the validity of the CSRF token before any other processing.

646 |

647 | 648 |

649 |

Limit access to protected resources

650 | 651 |

It is possible for an attacker to advertise a Webmention endpoint that points to an arbitrary URL. As such, if you install software that sends Webmentions on a server that is behind a firewall or otherwise has access to normally protected resources, you should be aware that an attacker can cause the server to send a POST request to an internal server. You SHOULD take precautions to ensure this server cannot access protected resources by either:

652 | 653 |

running the sender in an environment that does not have access to such internal resources
proxying all HTTP requests from this sender through a proxy that blocks access to internal resources

657 |

658 | 659 |

660 |

Security and Privacy Review

661 | 662 |

These questions provide an overview of security and privacy considerations for this specification as guided by Self-Review Questionnaire: Security and Privacy ([[security-privacy-questionnaire]]).

663 | 664 |

Does this specification deal with personally-identifiable information?: The only potentially personally-identifiable information involved in Webmention are the source and target URLs.
Does this specification deal with high-value data?: No, there is no authentication or other credentials involved.
Does this specification introduce new state for an origin that persists across browsing sessions?: No
Does this specification expose persistent, cross-origin state to the web?: The Webmention receiver may create a temporary resource with information about the Webmention request.
Does this specification expose any other data to an origin that it doesn't currently have access to?: No
Does this specification enable new script execution/loading mechanisms?: No
Does this specification allow an origin access to a user's location?: No
Does this specification allow an origin access to sensors on a user's device?: No
Does this specification allow an origin access to aspects of a user's local computing environment?: No
Does this specification allow an origin access to other devices?: No
Does this specification allow an origin some measure of control over a user agent's native UI?: No
Does this specification expose temporary identifiers to the web?: No
Does this specification distinguish between behavior in first-party and third-party contexts?: No
How should this specification work in the context of a user agent's "incognito" mode?: Webmention does not maintain any state so there are no considerations when in "incognito" mode.
Does this specification persist data to a user's local device?: No
Does this specification allow downgrading default security characteristics?: No

698 |

699 | 700 |

701 | 702 |

703 |

Other Considerations

704 | 705 |

706 |

Sending Webmentions from non-HTML content

707 | 708 |

If your source document is not HTML, (such as a PDF), or is otherwise restricted from fetching the raw source via a plain HTTP GET request, (such as behind a paywall, or requires a click-through license agreement), you will need to set up an HTML "landing page" that lists all the targets you wish to send Webmentions to. After creating this HTML landing page, you can use its URL as the source URL when sending Webmentions. This gives receivers a URL they can fetch to verify the link to their target URL, while avoiding making the complete source document public.

709 | 710 |

Creating an HTML landing page can help increase the number of inbound links to your content, by providing people with a useful place to link to when referencing otherwise restricted content such as scholarly articles. In the case of a scholarly article, the landing page should include the list of references in the HTML, so that you can use them as Webmention target URLs.

711 |

712 | 713 |

714 |

Respecting cache headers on discovery

715 | 716 |

When performing Webmention discovery, Senders SHOULD respect the HTTP cache headers [[RFC7234]] returned by the target URL and avoid fetching the target URL more often than is indicated by the headers.

717 |

718 |

719 | 720 |

721 |

IANA Considerations

722 | 723 |

The link relation type below has been registered by IANA per Section 724 | 6.2.1 of [[!RFC5988]]:

725 | 726 |

Relation Name:: webmention
Description:: Identifies a target URI that supports the Webmention protocol. This 733 | allows clients that mention a resource in some form of publishing 734 | process to contact that endpoint and inform it that this resource has 735 | been mentioned.
Reference:: W3C Webmention 739 | Specification (http://www.w3.org/TR/webmention/)
Notes:: This is a similar "Linkback" mechanism to the ones of Refback, 743 | Trackback, and Pingback. It uses a different protocol, though, and thus 744 | should be discoverable through its own link relation type.

747 |

748 | 749 |

750 |

URIs for Form-Encoded Properties

751 | 752 |

If your implementation wants to treat the source and target parameters as URIs, you can prefix the terms with http://www.w3.org/ns/webmention#.

753 |

754 | 755 |

756 |

Extensions

757 | 758 |

The following Webmention Extension Specifications have 2+ interoperable implementations live on the web and are thus listed here:

759 | 760 |

761 |

Vouch

762 |

The [[Vouch]] protocol is an anti-spam extension to Webmention.

763 |

764 | 765 |

766 |

Salmention

767 |

The [[Salmention]] protocol is an extension to Webmention to propagate comments and other interactions upstream.

768 |

769 | 770 |

771 |

Private Webmention

772 |

The [[Private-Webmention]] protocol is an extension to Webmention that supports sending and verifying Webmentions for posts that have access control.

773 |

774 | 775 |

776 | 777 |

778 |

Resources

779 | 780 |

781 |

788 |

789 | 790 |

791 |

Articles

792 | 793 |

You can find a list of articles about Webmention on the IndieWeb wiki.

794 |

795 | 796 |

797 |

Implementations

798 | 799 |

You can find a list of Webmention implementations on webmention.net

800 |

801 | 802 |

803 | 804 |

805 |

Acknowledgements

806 | 807 |

The editor wishes to thank Sandeep Shetty 808 | for contributing the original draft of the Webmention specification.

809 |

Additionally, the editor wishes to thank the IndieWeb 810 | community and other implementers for their support, encouragement and enthusiasm, 811 | including but not limited to: Amy Guy, Benjamin Roberts, Ben Werdmüller, Dave Wilkinson, Rob Sanderson, and Tantek Çelik.

812 |

813 | 814 |

815 |

Change Log

816 | 817 |

818 |

Changes from 24 May 2016 CR to this version

819 | 820 |

Replaced "client" with "sender" to match the roles defined in the spec
Clarify that senders should only look for HTML link and a tags in HTML documents
Added text to security considerations for Webmention to clarify that it allowed to use HEAD request during verification
Moved suggested specific limit of number of redirects to follow into the security considerations section
In conformance criteria, clarify that the Sender does not need to be the one creating the source document
Add intro section describing when you would send a Webmention and describing creating a source document
Use the term "mentions" instead of "links to" to cover the plaintext case as well
Added a section on creating a landing page for non-HTML or restricted access source documents
Removed plaintext English example from response body
Expand introduction paragraph, add section linking to Social Web Protocols document
Update RFC 2616 references to RFC 7231
Add note about respecting cache headers and customizing the user agent
Add Security and Privacy Questionnaire
Updated reference from RFC 3986 to WHATWG URL
Added link to Private Webmention extension

837 |

838 | 839 |

840 |

Changes from 29 April 2016 WD to 24 May 2016 CR

841 | 842 |

Moved list of implementations to webmention.net
MUST reject Webmentions where source == target, since most current implementations are already doing this.
Remove normative requirement on Salmention.

847 |

848 | 849 |

850 |

Changes from 20 April 2016 WD to 29 April 2016 WD

851 | 852 |

Added link to test suite in document header
Added section describing how to submit implementation reports
Clarified implementation must meet all listed criteria
Minor typo fixes
Clarified moderation is a MAY since verification is already a MUST in 3.2.2

859 |

860 | 861 |

862 |

Changes from 29 March 2016 WD to 20 April 2016 WD

863 | 864 |

Minor typo fixes
Updated discovery to prioritize link and a tags in document order
Added Webmention.rocks to the list of tools
Added note that if the Webmention endpoint contains query string parameters, they must be preserved
Added note and example of a CSRF prevention technique
Added security consideration about limiting access to protected resources

872 |

873 | 874 |

875 |

Changes from 1 March 2016 WD to 29 March 2016 WD

876 | 877 |

Updated list of implementations
Non-normative language and phrasing clarifications
Added section on sending Webmentions for updated and deleted posts
Added conformance criteria and classes section
Added localhost security consideration
Added a note on how to convert source and target parameter names to URIs

885 |

886 | 887 |

888 |

Changes from 12 January 2016 FPWD to 1 March 2016 WD

889 | 890 |

This section lists changes from the 12 January 2016 FPWD to this Working Draft

891 | 892 |

Minor typo and formatting corrections
Add IANA Considerations section to register rel=webmention with IANA
Add a note that receivers SHOULD remove the fragment before checking if it is a supported URL. Issue #24
Clarify "Receiving Webmentions" introduction paragraph
Update list of implementations
Correct the capitalization of Webmention and Pingback

900 |

901 |

902 | 903 | 904 | 905 | -------------------------------------------------------------------------------- /implementation-reports/summary/index.html: -------------------------------------------------------------------------------- 1 | 2 |

	A	B	C	D	E	F	G	H	I	J	K	L	M	N
1		10	Editor(s)	Member(s)		Outside WG
2	Sender Tests	Impls	Telegraph	Postly	Falcon	Bridgy	Dobrado	GNUSocial	Grav	Kaku	Processwire			Known
3	Discovery #1	8	1		1	1	1	1	1	1	1
4	Discovery #2	9	1		1	1	1	1	1	1	1			1
5	Discovery #3	10	1	1	1	1	1	1	1	1	1			1
6	Discovery #4	10	1	1	1	1	1	1	1	1	1			1
7	Discovery #5	10	1	1	1	1	1	1	1	1	1			1
8	Discovery #6	10	1	1	1	1	1	1	1	1	1			1
9	Discovery #7	9	1		1	1	1	1	1	1	1			1
10	Discovery #8	10	1	1	1	1	1	1	1	1	1			1
11	Discovery #9	9	1		1	1	1	1	1	1	1			1
12	Discovery #10	9	1		1	1	1	1	1	1	1			1
13	Discovery #11	10	1	1	1	1	1	1	1	1	1			1
14	Discovery #12	10	1	1	1	1	1	1	1	1	1			1
15	Discovery #13	8	1		1	1	1		1	1	1			1
16	Discovery #14	10	1	1	1	1	1	1	1	1	1			1
17	Discovery #15	8	1		1		1	1	1	1	1			1
18	Discovery #16	10	1	1	1	1	1	1	1	1	1			1
19	Discovery #17	8	1		1	1	1		1	1	1			1
20	Discovery #18	10	1	1	1	1	1	1	1	1	1			1
21	Discovery #19	9	1	1	1		1	1	1	1	1			1
22	Discovery #20	9	1	1	1		1	1	1	1	1			1
23	Discovery #21	10	1	1	1	1	1	1	1	1	1			1
24	Sending Accept 200	10	1	1	1	1	1	1	1	1	1			1
25	Sending Accept 201	10	1	1	1	1	1	1	1	1	1			1
26	Sending Accept 202	10	1	1	1	1	1	1	1	1	1			1
27	Update #1	7	1	1			1		1	1	1			1
28	Update #2	6		1			1		1	1	1			1
29	Delete #1	6		1			1		1	1	1			1
30	Avoid Loopback	5					1	1	1	1				1
31	Salmention Extension	2		1			1
32	Vouch Extension	3		1					1		1
33		11
34	Receiver Tests	Impls	Webmention.io	Postly		Bridgy	Dobrado	GNUSocial	Grav	Kaku	Processwire	FrancisCMS	herokuapp	Known
35	Responds with 200	4				1	1	1						1
36	Responds with 201	3	1			1			1
37	Responds with 202	7		1			1		1	1	1	1	1
38	Rejects invalid URLs	10	1	1		1	1	1	1	1	1	1		1
39	Verifies target is a valid resource	7				1	1	1	1	1	1	1	n/a
40	Ignores fragment	8		1		1	1	1		1	1	1		1
41	Processed Async	8	1	1			1		1	1	1	1	1
42	Follows one redirect	11	1	1		1	1	1	1	1	1	1	1	1
43	Self-imposed limit on redirects	10	1	1		1	1	1	1	1	1	1		1
44	Source URL HTML content type	11	1	1		1	1	1	1	1	1	1	1	1
45	Source URL text content type	5		1		1		1	1	1
46	HTML verification <a>	11	1	1		1	1	1	1	1	1	1	1	1
47	HTML verification <img>	7		1		1		1	1	1	1			1
48	HTML verification <video>	7		1		1		1	1	1	1			1
49	HTML verification <audio>	7		1		1		1	1	1	1			1
50	HTML verification reject text	5	1				1		1	1		1
51	HTML verification reject link in comment	4	1				1		1	1
52	HTML verification no URL	10	1	1		1	1	1	1	1	1	1		1
53	Displays data	8		1			1	1		1	1	1	1	1
54	Recognizes "in-reply-to"	9	1	1		1	1	1			1	1	1	1
55	Recognizes a "like"	9	1	1		1	1	1			1	1	1	1
56	Recognizes a "repost"	9	1	1		1	1	1			1	1	1	1
57	Recognizes an "RSVP"	6	1			1	1	1					1	1
58	Does not treat an update as a new comment	10	1	1		1	1	1	1	1	1		1	1
59	Removes the response when update has no link	6		1			1		1	1	1		1
60	Updates information from the primary object	9	1	1			1	1	1	1	1		1	1
61	Updates information from children	2		1			1
62	Recognizes HTTP 410 as delete	6		1			1		1	1	1			1
63	Moderated before being displayed	3		1					1			1
64	Periodically re-verified*	1							1
65	Filters/encodes to prevent XSS	8	1	1			1	1		1	1		1	1
66	Self-imposed limit on time fetching	9	1	1		1	1	1	1	1	1			1
67	Self-imposed limit on bytes fetched	3				1			1					1
68	Accepts additional parameters, so has CSRF protection	3								1		1		1
69	Salmention extension	2		1			1
70	Vouch extension	3		1					1		1
71
72	* this feature does not affect interoperability

3 | 40 | --------------------------------------------------------------------------------