Open liamdennehy opened 5 years ago
A complex matter indeed :)
Can you please provide some more context on that?
afaik:
A-R
, to access the request context.
A-R
is not provided by the application server.A-R
should provide the validation of the signature and the signature response.When I validate any digital signature I should have all the information to hand that goes into that signature to construct the signed data consistently. Compare S/MIME, Signed PDFs, JWS etc.
However the :method
, :path
and :query
parms are not transmitted in a response, so we need an independent source. For now the assumption is simply the state known to the server (responding to a request presenting this info) and the client (expecting a response to the request just transmitted with this info).
Two cases present issues:
(request-target)
in addition to the HTTP response itself, meaning any store of these artefacts need to do the same. Again, more complexity.Simply adding it as a header makes the most sense. This doesn't mean the value is correct (a response may present a different representation of the URI) but is an unequivocal source for the pseudo-header's value.
Omitting this information as a whole from any signed response doesn't make too much sense. All we would have is a signed representation, but without the request info there is insufficient context to know what the data means unless the content expresses this explicitly.
We are asymptotically tending to signed-exchanges :P
Right now there is no way for a response to transport all the parameters required to reconstruct the
(request-target)
signing string component.As the messages are exchanged obviously both the client and server know the values, as one transmitted and the other reacted to those in the other half of the conversation, but any signature should be verifiable given only the evidence of the content it protects.
Since this information is not present on a response,
(request-target)
should be prohibited from appearing in a response signature's headers. If required the server should construct a header specifically for this purpose, which could be as simple asRequest-Target
, and so no special handling is required to sign it.