Open msporny opened 4 years ago
My interpretation is that the client should first percent-encode the :path pseudo header, then use that value for the purpose of signing. On the receiving side, the server should validate the signature by concatenating the value of the :path pseudo header before decoding the header value.
Yes, I believe that interpretation is correct... and the spec should clarify that without duplicating the text in RFC 3986.
GET /foo%20bar?q=%3Apath HTTP/1.1
Unsure why you've escaped the colon, since this is a valid pchar
for a query:
URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ]
query = *( pchar / "/" / "?" )
pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
Illustrating escaped query & path characters is useful, so I propose showing the transform of (in yaml):
path: '/foo bar'
query:
- name: test
value: this=that
- name: actions
value: first&second
into
/foo%20bar?test=this%3Dthat&actions=first%26second
New content and updated reference test sample message in https://github.com/w3c-dvcg/http-signatures/pull/83/commits/390aee411bce8236ff321ec690e6b523900abcc3:
canonicalization
for both :path and :query, refer to RFC3986 for reasoning (and add as new normative ref)
Sebastien Rosset wrote:
For example, instead of the following example
You could use something like this: