HTTP Message Signatures with curl

HTTP Message Signatures with curl | daniel.haxx.se

Search for:

The recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them.

Message Signatures

The specification describes this as a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. It is a way to verify that selected parts of the HTTP request arrives unmodified and exactly the same as when the request was created by the client.

These days, it is very common that there are layers of proxies, load balancers, front-ends, CDNs, web firewalls and what not in between the client and the ultimate application. With HTTP Message Signatures, there can be assurances that the headers are components of the request end are unaltered.

Command line

This functionality comes with four new command line options to allow users to use its full power:

--httpsig-algo allows the user to specify which algorithm to use, with ed25519 being used by default. The only other algorithm supported right now is hmac-sha256.

--httpsig-key specifies the key to use when signing the request.

--httpsig-keyid is the key identifier, a string that is passed on in the headers.

--httpsig-headers details exactly which parts of the request and which headers that should be signed. If not set, it defaults to signing the method, authority, path and query.

With these four new flags added to the list, curl supports 278 different command line options.

libcurl

The corresponding options of course also exist as options for curl_easy_setopt:

CURLOPT_HTTPSIG_ALGORITHM: signing algorithm ("ed25519" or "hmac-sha256")

CURLOPT_HTTPSIG_KEY: the key to use for the signing

CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input

CURLOPT_HTTPSIG_HEADERS: a space-separated list of components to sign

Experimental

This feature is marked experimental. This means that it need to be explicitly enabled in the build to appear, and that we strongly discourage use of it in production as we reserve the rights to change it before it gets supported for real. We use the experimental phases as a time for people to test it, to tweak it and to learn what we should fix so that we then can support this to the end of time. We do not guarantee any backward compatibility for experimental features.

Please test this feature and tell us how you experienced it! The more tests and more feedback we get, the faster we can get moved out of the experimental phase to have it present for real for everyone.

Ships

This feature is already merged into git and will be part of the pending curl 8.22.0 release. As experimentally supported.

Credits

This feature was graciously brought to us by Sameeh Jubran.

Top image by Antonios Ntoumas from Pixabay

2 thoughts on “HTTP Message Signatures with curl”

I’m not sure whether PUTI realizes or not that AI generated posts, apart from being downright insulting, are easily recognizable.

@Nun: yes thanks, I have since removed all of PUTI’s comments on this blog since they added nothing and seemed to be AI generated.

Leave a Reply Cancel reply<br>Your email address will not be published. Required fields are marked *<br>Comment *<br>Name *

Email *

Website

Time limit is exhausted. Please reload CAPTCHA.<br>two2577

This site uses Akismet to reduce spam. Learn how your comment data is processed.

HTTP Message Signatures with curl

Related Articles

(no title)

Scientists reverse brain aging, with a nasal spray

AI has torched the market for junior programmers

Al Vigier: Canada's AI strategy shouldn't include secret Palantir bills

The Anatomy of an AI-Native Org