w3c-ccg / http-signatures

Signing HTTP Messages specification

https://w3c-dvcg.github.io/http-signatures/

w3c-ccg/http-signatures Issues

IPv6 over Networks of Resource-constrained Nodes (6lo)
Updated 2 years ago
HTTP Signatures for Solid
Updated 2 years ago6
Example RSA Key in the draft is not FIPS compliant
Updated 4 years ago
A.3.2.1. Minimal Required Signature Header seems wrong
Updated 4 years ago
Archiving this repository?
Updated 4 years ago6
`algorithm` parameter does not make sense
Updated 4 years ago2
Proposal to add (response-code) special header
Updated 4 years ago1
Status of the Authorization header
Updated 4 years ago
HTTP-Signatures discussed at IETF106
Updated 4 years ago3
Stance on using Query String instead of Header
Updated 4 years ago3
Test RSA key is only 1024 bit, not 2048 bit as it says
Updated 4 years ago2
Inconsistencies relating to "(created)" pseudo-header
Updated 4 years ago
ECDSA signature encoding, binary IEEE P.1363 or ASN.1
Updated 4 years ago
Inconsistent use of \n in examples
Updated 4 years ago
Wrong reference in section 3.1. "Authorization Header"
Updated 4 years ago1
Inconsistent use of space character in section C Test Values
Updated 4 years ago
Typo in sections 3.1.2, 3.1.3, 4.1.1 and 4.1.2, RSA and HMAC examples
Updated 4 years ago
Small typo in section 2.1.5
Updated 4 years ago
Reformat list of recommendations in section E.2
Updated 4 years ago
HTTP signature scheme in the IANA Authentication Scheme Registry
Updated 4 years ago
Discussion: relations with alt-svc
Updated 5 years ago
Delimit Signature Header Parameters With Semi-colon
Updated 5 years ago
Support a versioning scheme
Updated 5 years ago3
Algorithm signature parameter is too complex
Updated 5 years ago
:path pseudo header encoding
Updated 5 years ago3
Project stance on signatures incorporating external data
Closed 5 years ago3
Project stance on signature & parameter negotiation
Closed 5 years ago1
Project stance on multiple header instances
Closed 5 years ago2
Don't trust ambiguous parameters
Closed 5 years ago10
Project stance on backwards compatibility
Updated 5 years ago
Signing string should include keyId and algorithm (if present) via pseudo headers
Updated 5 years ago3
Concatenation of multiple-instance headers in signing string
Updated 5 years ago10
Consider removing the `headers` field to the `Signed-Headers` header field.
Updated 5 years ago5
Missing pseudo headers in draft version #11 examples
Updated 5 years ago
Proposal to Drop Normative Statements the depend on HTTP Message Parser behavior.
Closed 5 years ago1
Forbid empty `headers` parameter as it's subject to replay attacks.
Closed 5 years ago8
Status of this RFC related to European PSD2 (Berlin group) ?
Closed 5 years ago9
header and signature parameters are confusing.
Closed 5 years ago2
links to encryption algorithims documents in hsa registry go nowhere.
Closed 5 years ago2
Implementation should throw if it would overwrite an Existing Authorization or Signature Header.
Updated 5 years ago7
Forbid "(request-target)" in response signature
Updated 5 years ago3
Dis-entangle this spec from Digest
Updated 5 years ago
HMAC example is illustrated with headers, not *without*
Updated 5 years ago1
Digest acts on the representation-data, not the message body
Updated 5 years ago
Add sample code for generate examples.
Updated 5 years ago
created and expires should be signed if present
Updated 5 years ago1
2.1.2 signature in version 11 spec still tells people to use the algorithm parameter to sign.
Updated 5 years ago2
Creating and Signing the Signature String
Updated 5 years ago14
Presentation issues for the test vectors
Updated 5 years ago1
PROPOSAL: move index.xml to index.md
Closed 5 years ago2