HTTP Integrity Algorithm Selection

HTTP digest and signature mechanisms detect alteration only when sender and recipient cover the same bytes and validate the algorithm and context.

Prefer SHA-256 or stronger approved algorithms, define whether content or the selected representation is covered, and pair integrity with authentication, freshness, and authorization checks.

httpintegritysecurityheader

Reference (http)

Content-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=:
Repr-Digest: sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZc3g=:

Prefer SHA-256 or stronger approved algorithms, define whether content or the selected representation is covered, and pair integrity with authentication, freshness, and authorization checks.

Common mistakes

Computing the digest over decoded bytes when the protocol covers encoded content, or treating a matching digest as proof of sender identity.

HTTP Content Digests Authorization Header Proxies, Gateways, and Forwarded Headers

Sources