Client tests · Discovery
C112 Ignores a metadata link in the page body
Recommended Sign in with your client
What this test does
The real link is in <head>. A second indieauth-metadata link, pointing at a decoy server, is in the page body — where comments, bios and other people's content end up on many sites.
How it passes
Your client uses the link from <head> and never touches the decoy. Reading links from the body lets anyone who can put HTML on a page choose its server.
- Specification
- §4.1