HTTP Message Signature Validation

HTTP Message Signatures authenticate selected HTTP components using a signature input definition and a cryptographic signature.

Validate the key, covered components, derived component values, created/expires bounds, nonce policy, and request context. Signatures do not automatically protect headers that were left out.

httpintegritysecuritysignaturesheader

Reference (http)

Signature-Input: sig1=("@method" "@target-uri" "content-digest");created=1720000000;keyid="api-key"
Signature: sig1=:base64-signature:

Validate the key, covered components, derived component values, created/expires bounds, nonce policy, and request context. Signatures do not automatically protect headers that were left out.

Common mistakes

Verifying only the cryptographic bytes while ignoring covered-component names, timestamp freshness, key scope, or replay protection.

HTTP Content Digests Authorization Header Proxies, Gateways, and Forwarded Headers

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
IANA HTTP Field Name Registry
RFC 9421: HTTP Message Signatures
RFC 9530: Digest Fields