search

atomicdata-dev / atomic-data-docs

Atomic Data is a specification to make it easier to exchange data.
https://docs.atomicdata.dev
MIT License
17 stars 7 forks source link

Use expiration time in x-atomic HTTP authorization #140

Open joepio opened 1 year ago

joepio commented 1 year ago

Currently, in HTTP auth, we use the current timestamp and the server has a hard-coded max age for signed headers.

This gives no control to the client regarding how long a signature should be valid. We could invert this control by setting an expiration date instead of a timestamp.