500 Internal Server Error in follow-server example with `behindProxy` or explicit `origin`

[bglgwyng]

follow-server example worked well with NodeJS, until I introduced an hono instance + fedify middleware.
https://github.com/bglgwyng/follow-server/blob/main/server.ts#L80-L93

The following error message only shows up when using an hono instance. Directly serving federation via federation.fetch doesn't make this issue.

16:46:12.295 KST POST /users/me/inbox           500 Internal Server Error 

logtape tells nothing about this failure.

versions:
@fedify/fedify: 1.5.0
@hono/node-server: 1.14.0
hono: 4.7.5

[bglgwyng]

Seems sendActivity cause this issue.

{"error":"Verification failed for me@d817-115-23-198-185.ngrok-free.app https://d817-115-23-198-185.ngrok-free.app/users/me using rsa-sha256 (RSASSA-PKCS1-v1_5 with SHA-256)","signed_string":"(request-target): post /users/braulus_artaelun/inbox\ncontent-type: application/activity+json\ndate: Sat, 29 Mar 2025 08:36:44 GMT\ndigest: SHA-256=kG8FSfkyUoT6CP7Z1B9nJms+Wamyoj2w1cvtGEoItdw=\nhost: activitypub.academy","signature":"MzwU8eOAZZ0bXs2vflRZB+SJBHBjbRYLvuMnIX5xN9yEdPBhH4CTF+Z2mqmCbFdeigznYJHRQ8ByMkmy+dYAiYANuWvvcr4w5WqOqJ6XLHp/m1KUJMT/kAZSo/ySNdQWkKSY5SUUgM0FjxK/zF0GGj2DJx+qnDAe/E+7tpsj7ZHjpGRz0atXa24QbwItxsjwKR21/0fS70qlzNHPEgRWArC10ry9CHqG48tMHV1U4l7B3qkcT4AhTfQfoaACXUa+X6+jWl1J2egBppxTtIXESJjLQ7Q4LMcu/bxq4JNq1nfpQCP5hUWpq2X9CIm7dSCSMPR1lKs1KWEgHdSjesvAUPRKnW+aD/BeBOUAVnPqRf9h3PFvKnuv3VWo8pWJzh/mB5JUwmPnzcaq8vIGoq5dN34YAAJ1+ndr4s+kfJ9WnxRMLY9sXgZlRyqoqajvR3v7IIq4ziSTKnLZIktUvJoJbi7qLhhAitMEDeD1dkAYRAM0fXtPAB8Uf3XwD8fupvzF+QiOIeXo2Dr3N+3IheQFtfIwlM5kW3AJzveLBt517jTV51UyfWkExzOfybQyyA/2L/mK7CaAN6MMx36zdU26WbOHCWc9nhWlagd1pE3tORhdnJnQ02zB4NuNfwsQx/dIK0pT55YUZ4SBYFVKWuPU5nMzkyAhQ25QiCEa5Ex8xkE="}
    at sendActivityInternal (file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/send.js:127:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/send.js:57:13
    at async Promise.all (index 0)
    at async FederationImpl.sendActivity (file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/middleware.js:1279:13)
    at async InboxContextImpl.sendActivityInternal (file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/middleware.js:2142:13)
    at async file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/middleware.js:2035:17
    at async <anonymous> (/Users/bglgwyng/Documents/GitHub/follow-server/server.ts:80:3)
    at async file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/inbox.js:113:13
    at async routeActivity (file:///Users/bglgwyng/Documents/GitHub/follow-server/node_modules/@fedify/fedify/esm/federation/inbox.js:99:12) {
  [stack]: [Getter/Setter],
  [message]: 'Failed to send activity https://d817-115-23-198-185.ngrok-free.app/#Accept/ee093dac-3d1d-40c9-8953-77ee544b5fc2 to https://activitypub.academy/users/braulus_artaelun/inbox (401 Unauthorized):\n' +
    '{"error":"Verification failed for me@d817-115-23-198-185.ngrok-free.app https://d817-115-23-198-185.ngrok-free.app/users/me using rsa-sha256 (RSASSA-PKCS1-v1_5 with SHA-256)","signed_string":"(request-target): post /users/braulus_artaelun/inbox\\ncontent-type: application/activity+json\\ndate: Sat, 29 Mar 2025 08:36:44 GMT\\ndigest: SHA-256=kG8FSfkyUoT6CP7Z1B9nJms+Wamyoj2w1cvtGEoItdw=\\nhost: activitypub.academy","signature":"MzwU8eOAZZ0bXs2vflRZB+SJBHBjbRYLvuMnIX5xN9yEdPBhH4CTF+Z2mqmCbFdeigznYJHRQ8ByMkmy+dYAiYANuWvvcr4w5WqOqJ6XLHp/m1KUJMT/kAZSo/ySNdQWkKSY5SUUgM0FjxK/zF0GGj2DJx+qnDAe/E+7tpsj7ZHjpGRz0atXa24QbwItxsjwKR21/0fS70qlzNHPEgRWArC10ry9CHqG48tMHV1U4l7B3qkcT4AhTfQfoaACXUa+X6+jWl1J2egBppxTtIXESJjLQ7Q4LMcu/bxq4JNq1nfpQCP5hUWpq2X9CIm7dSCSMPR1lKs1KWEgHdSjesvAUPRKnW+aD/BeBOUAVnPqRf9h3PFvKnuv3VWo8pWJzh/mB5JUwmPnzcaq8vIGoq5dN34YAAJ1+ndr4s+kfJ9WnxRMLY9sXgZlRyqoqajvR3v7IIq4ziSTKnLZIktUvJoJbi7qLhhAitMEDeD1dkAYRAM0fXtPAB8Uf3XwD8fupvzF+QiOIeXo2Dr3N+3IheQFtfIwlM5kW3AJzveLBt517jTV51UyfWkExzOfybQyyA/2L/mK7CaAN6MMx36zdU26WbOHCWc9nhWlagd1pE3tORhdnJnQ02zB4NuNfwsQx/dIK0pT55YUZ4SBYFVKWuPU5nMzkyAhQ25QiCEa5Ex8xkE="}'
}

[bglgwyng]

It was actually due to a missing public key for an actor.