HTTP Message Signatures for Automated Traffic

https://www.ietf.org/archive/id/
Admin
HTTP Message Signatures for Automated Traffic is a protocol enabling automated HTTP clients to...
Tokens:21,965
Snippets:145
Trust Score:10
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### RSA-PSS-SHA512 Signature Base (Legacy sf-string)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature base for the RSA-PSS-SHA512 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments.

```http
"@authority": example.com
"signature-agent": "https://signature-agent.test"
"@signature-params": ("@authority" "signature-agent")\
 ;created=1735689600\
 ;keyid="oD0HwocPBSfpNy5W3bpJeyFGY_IQ_YpqxSjQ3Yd-CLA"\
 ;alg="rsa-pss-sha512"\
 ;expires=1735693200\
 ;nonce="XSHtZVCThSIAksXsH9WBs6AtxtXC0eQGiIcUGSoJstFs8lAWakjhrfwzLhyjtme5iXMZvmFWqDEs6cT3Jf+BbQ=="\
 ;tag="web-bot-auth"
```

--------------------------------

### RSA-PSS-SHA512 Signature Headers (Legacy sf-string)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature-Input and Signature headers for the RSA-PSS-SHA512 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments.

```http
Signature-Agent: "https://signature-agent.test"
Signature-Input: sig2=("@authority" "signature-agent")\
 ;created=1735689600\
 ;keyid="oD0HwocPBSfpNy5W3bpJeyFGY_IQ_YpqxSjQ3Yd-CLA"\
 ;alg="rsa-pss-sha512"\
 ;expires=1735693200\
 ;nonce="XSHtZVCThSIAksXsH9WBs6AtxtXC0eQGiIcUGSoJstFs8lAWakjhrfwzLhyjtme5iXMZvmFWqDEs6cT3Jf+BbQ=="\
 ;tag="web-bot-auth"
Signature: sig2=:I1QWNzGXdP1a4dSvOHLCVOOanEYHDk+ZsVxM9MLX/p4ko69ghKwR5EOtAD96g7g4GWP7lmpM/jFAf9q8EFRDTPLjUXySwMv4YPgabv2LQihTJG2y8a2m6IGltyruwQNiqSJVUuRaG9+b17CGmAMFZh30X6GXLdQJrCARpeTqPwp2DC+a8haDE/VE5EruqzjA5/2mKwvrkzkSqeW5tOVtFwWRRHIOidquf/8Je6kM9mhgkg4arudLA5SL4wyyYE1jURIgcOl8agrfdJ5Def23DIRtiOLRa8jT9cpTLFAuFHN+mrZA/LH9h0gSIg1cPb+0cMASee5uku1KjWcFer7jWA==:
```

--------------------------------

### Directory fetch request and response with JWKS

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Example request to fetch the directory at the well-known URI and the corresponding 200 OK response with a JWKS body. The directory must be served over HTTPS with media type application/http-message-signatures-directory+json.

```http
GET /.well-known/http-message-signatures-directory HTTP/1.1
Host: example.com
Accept: application/http-message-signatures-directory+json
```

```http
HTTP/1.1 200 OK
Content-Type: application/http-message-signatures-directory+json
Cache-Control: max-age=86400
{
  "keys": [{
    "kty": "OKP",
    "crv": "Ed25519",
    "kid": "NFcWBst6DXG-N35nHdzMrioWntdzNZghQSkjHNMMSjw",
    "x": "JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs",
    "use": "sig",
    "nbf": 1712793600,
    "exp": 1715385600
  }]
}
```

--------------------------------

### Signature-Agent member examples for directory, jwks_uri, and cimd

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Shows the three Signature-Agent member forms: default directory (no type parameter), jwks_uri, and cimd. The type parameter names how the URL resolves to key material.

```http
Signature-Agent: sig1="https://signature-agent.test"
Signature-Agent: sig1="https://signature-agent.test/jwks.json";type=jwks_uri
Signature-Agent: sig1="https://signature-agent.test/card";type=cimd
```

--------------------------------

### RSA-PSS-SHA512 Signature Headers (Dictionary Form)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature-Input and Signature headers for the RSA-PSS-SHA512 example with dictionary-form Signature-Agent. The signature is computed over the corresponding signature base.

```http
Signature-Agent: agent2="https://signature-agent.test"
Signature-Input: sig2=("@authority" "signature-agent";key="agent2")\
 ;created=1735689600\
 ;keyid="oD0HwocPBSfpNy5W3bpJeyFGY_IQ_YpqxSjQ3Yd-CLA"\
 ;alg="rsa-pss-sha512"\
 ;expires=4889289600\
 ;nonce="wcfPQPh7SzkvrIVvhD00vNk9PkxJNY2NVbYl2PVBB4zmUoluSwE7W6bPtF60QA3k8g06FU7PPCD+J58YofY1zg=="\
 ;tag="web-bot-auth"
Signature: sig2=:gHzpLNeHaHIO19NaJH9YMW5dcVSi2s0wOMBr6p18vcofS106sfC4KBIS0/szPlBBd1vIcyQ88B6CTEWIhRAiVrb9zfX0mx1aG12CSGWcYkSirHeyTxhbuJvXd27ed6skWoy4PjXItq38936ivUQjfdIwXh1aX6HxkAC3vRnEdSNfntkLWeEuIQ5BLIOBGE39fSwg27Qjq6OVWYas/9/aFUr3HA34MXWYdp+//cvlEKDp3kRoLOw9ro0AOr6srHrTeEtxon2afcws1aZVSlPdd2fZSEIGmw9HAHLDCEkFTERu1gH2k/zIEqgy7CAYXI9E5slog0cLg/Vc6+f8gih33g==:
```

--------------------------------

### Ed25519 Signature Headers (Dictionary Form)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature-Input and Signature headers for the Ed25519 example with dictionary-form Signature-Agent. The signature is computed over the corresponding signature base.

```http
Signature-Agent: agent2="https://signature-agent.test"
Signature-Input: sig2=("@authority" "signature-agent";key="agent2")\
 ;created=1735689600\
 ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\
 ;alg="ed25519"\
 ;expires=4889289600\
 ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\
 ;tag="web-bot-auth"
Signature: sig2=:RdNFx5Bj6au3YgAMQL/RzmUlZE8QZLIaXGRpw985hWnwPfMxT228NMk6ehRS1PSl4e8PhbNZACSanGdhEwYCCg==:
```

--------------------------------

### HTTP Request with Signature Headers

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Example of a signed HTTP request using the web-bot-auth profile. Includes the Signature, Signature-Input, and Signature-Agent headers. The Signature-Input header uses line wrapping per RFC 8792.

```http
GET /path/to/resource HTTP/1.1
Host: origin.example.com
Signature: sig=abc==
Signature-Input: sig=("@authority" "signature-agent";key="sig");\
                    created=1700000000;\
                    expires=1700011111;\
                    keyid="ba3e64==";\
                    tag="web-bot-auth"
Signature-Agent: sig="https://signer.example.com"
```

--------------------------------

### Ed25519 Signature Headers (Legacy sf-string)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature-Input and Signature headers for the Ed25519 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments.

```http
Signature-Agent: "https://signature-agent.test"
Signature-Input: sig2=("@authority" "signature-agent")\
 ;created=1735689600\
 ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\
 ;alg="ed25519"\
 ;expires=4889289600\
 ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\
 ;tag="web-bot-auth"
Signature: sig2=:RdNFx5Bj6au3YgAMQL/RzmUlZE8QZLIaXGRpw985hWnwPfMxT228NMk6ehRS1PSl4e8PhbNZACSanGdhEwYCCg==:
```

--------------------------------

### Ed25519 Signature Base (Legacy sf-string)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature base for the Ed25519 example with legacy sf-string Signature-Agent. Retained for migration; do not use in new deployments.

```http
"@authority": example.com
"signature-agent": "https://signature-agent.test"
"@signature-params": ("@authority" "signature-agent")\
 ;created=1735689600\
 ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\
 ;alg="ed25519"\
 ;expires=4889289600\
 ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\
 ;tag="web-bot-auth"
```

--------------------------------

### Ed25519 Signature Base (Dictionary Form)

Source: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt

Signature base for the Ed25519 example with dictionary-form Signature-Agent. Used to validate the signature computation.

```http
"@authority": example.com
"signature-agent";key="agent2": "https://signature-agent.test"
"@signature-params": ("@authority" "signature-agent";key="agent2")\
 ;created=1735689600\
 ;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U"\
 ;alg="ed25519"\
 ;expires=4889289600\
 ;nonce="n9p433xm+NJ3ph3upfBIGmsuwHw387YV7Q/F+6BSpGCVjYCqQw6rznNA8PVVLySrAWsv0hQtFioQb6E1YsauiA=="\
 ;tag="web-bot-auth"
```
Tokens:
Raw