Implementing webmentions

I've been working on a number of connection points between my site and the broader web. Part of that effort has been webmentions (which are a fairly small spec). You advertise an endpoint and someone posts a source and target and, from there, you do with the information as you please. What expanded the scope of my implementation was that I wanted to pull in similarly shaped data from Mastodon and Bluesky. To receive a webmention, you have to advertise the endpoint in the head of your document: <link rel="webmention" href="/webmentions">. From there, the flow looks like this: I receive a post to /webmentions and verify that both the source and target are either http or https. The target must be on my site and the source isn't on a blocklist I maintain.1 I rewrite the target to my site's canonical host before I store it. This site was once served at the apex and is now served at the www subdomain, so mentions of the legacy, bare hostname are updated to include the subdomain. New…