Giters

pyauth / requests-http-signature

A Requests auth module for the IETF HTTP Message Signatures draft standard

Home Page:https://pyauth.github.io/requests-http-signature/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

HTTPSignatureAuth.verify does not parse Authentication header correctly

Diggsey opened this issue · comments

commented

Currently, it just splits on commas. However, I believe commas are allowed in eg. the keyId parameter if the value is enclosed in quotes.

Example:

Authentication: keyId="test,key",signature="...",algorithm="..."
commented

No, keyId should not contain commas. There is an in-progress work item on this in the draft spec (https://tools.ietf.org/html/draft-richanna-http-message-signatures-00#appendix-B.1.13).