search

w3c-ccg / http-signatures

Signing HTTP Messages specification
https://w3c-dvcg.github.io/http-signatures/
Other
34 stars 9 forks source link

Fix: #75. Reference representation data, not message body. #76

Open ioggstream opened 5 years ago

ioggstream commented 5 years ago

This PR

Fixes the ambiguity about message body. In HTTP the message body is subject to Transfer-Encoding and other transformations that might invalidate a signature.

Digest for example, is calculated on the instance (rfc3230) now standardized as representation data (rfc7231).

The now deprecated, rfc723x-inconsistent Content-MD5 instead was calculated on the payload body.