search

TritonDataCenter / node-http-signature

Reference implementation of Joyent's HTTP Signature Scheme
https://tritondatacenter.com
MIT License
404 stars 118 forks source link

Support latest draft #118

Open DeGuitard opened 3 years ago

DeGuitard commented 3 years ago

Hello,

The latest draft (v01) has been released on 17/11/2020. It introduces a breaking change in the HTTP Signature headers.

Before:

   Signature: keyId="test-key-a", created=1402170695,
       headers="(created) (request-target)",
       signature="e3y37nxAoeuXw2KbaIxE2d9jpE7Z9okgizg6QbD2Z7fUVUvog+ZTKK
           LRBnhNglVIY6fAaYlHwx7ZAXXdBVF8gjWBPL6U9zRrB4PFzjoLSxHaqsvS0ZK
           9FRxpenptgukaVQ1aeva3PE1aD6zZ93df2lFIFXGDefYCQ+M/SrDGQOFvaVyk
           Ekte5mO6zQZ/HpokjMKvilfSMJS+vbvC1GJItQpjs636Db+7zB2W1BurkGxtQ
           dCLDXuIDg4S8pPSDihkch/dUzL2BpML3PXGKVXwHOUkVG6Q2ge07IYdzya6N1
           fIVA9eKI1Y47HT35QliVAxZgE0EZLo8mxq19ReIVvuFg=="

After:

   Signature-Input: sig1=(*created, *request-target);
       keyId="test-key-a"; created=1402170695
   Signature: sig1=:QaVaWYfF2da6tG66Xtd0GrVFChJ0fOWUe/C6kaYESPiYYwnMH9eg
       OgyKqgLLY9NQJFk7bQY834sHEUwjS5ByEBaO3QNwIvqEY1qAAU/2MX14tc9Yn7ELB
       naaNHaHkV3xVO9KIuLT7V6e4OUuGb1axfbXpMgPEql6CEFrn6K95CLuuKP5/gOEcB
       tmJp5L58gN4VvZrk2OVA6U971YiEDNuDa4CwMcQMvcGssbc/L3OULTUffD/1VcPtd
       GImP2uvVQntpT8b2lBeBpfh8MuaV2vtzidyBYFtAUoYhRWO8+ntqA1q2OK4LMjM2X
       gDScSVWvGdVd459A0wI9lRlnPap3zg==:

Is there any plan to support this new syntax with the new header Signature-Input?

Thanks a lot :).

arekinath commented 3 years ago

Honestly with the rate at which they've been making breaking changes in drafts lately I think it might be best to wait it out until they make it a proper RFC