The server should be able to require the client to sign certain headers, and reject any messages in which these headers are unsigned.
For example, a server should be able to require a signed digest header for POST requests, and reject any message that doesn't have a signed digest header.
This protects against sloppy clients "leaving the door open": if a POST request with an unsigned digest is intercepted, the message body can be manipulated without invalidating the signature, and the forged message would be accepted.
This could be prevented by supplying a list of required headers to the constructors of the Verifier and Verification classes.
It might be useful to supply two sets of headers, one for requests without a body, and another for messages with a body. (Note that DELETE requests may or may not have a body).
The server should be able to require the client to sign certain headers, and reject any messages in which these headers are unsigned. For example, a server should be able to require a signed
digestheader for POST requests, and reject any message that doesn't have a signed digest header.This protects against sloppy clients "leaving the door open": if a POST request with an unsigned digest is intercepted, the message body can be manipulated without invalidating the signature, and the forged message would be accepted.
This could be prevented by supplying a list of required headers to the constructors of the Verifier and Verification classes. It might be useful to supply two sets of headers, one for requests without a body, and another for messages with a body. (Note that DELETE requests may or may not have a body).
For reference: https://datatracker.ietf.org/doc/html/rfc9421#verify-requirements