HTTPSignatureAuth.verify does not parse Authentication header correctly
Diggsey opened this issue · comments
Currently, it just splits on commas. However, I believe commas are allowed in eg. the keyId
parameter if the value is enclosed in quotes.
Example:
Authentication: keyId="test,key",signature="...",algorithm="..."
No, keyId should not contain commas. There is an in-progress work item on this in the draft spec (https://tools.ietf.org/html/draft-richanna-http-message-signatures-00#appendix-B.1.13).