HTTP Message Signatures
HTTP Message Signatures: Entity Summary
HTTP Message Signatures, published as RFC 9421 in 2022, is the IETF standard for cryptographically signing parts of an HTTP message — such as method, path, and selected headers — so that receivers can verify the sender and detect tampering.
HTTP Message Signatures: Core Facts
- RFC number
- 9421
- Published
- 2022
- Signs
- Request method, URI, and selected header fields via the Signature and Signature-Input headers
- Algorithms
- Pluggable; Web Bot Auth uses Ed25519
- Role in Web Bot Auth
- The signing mechanism that Web Bot Auth standardizes directory publication and verification around
HTTP Message Signatures: Classification Metadata
- Entity Class
- Specification
- Status
- "Published RFC (2022)"
- Last verified
HTTP Message Signatures: Not Identical To
HTTP Message Signatures are not identical to OAuth, which proves a user's authorization via tokens. They are not identical to TLS client certificates, which authenticate at the transport layer. They are not identical to the older draft known as "http-signatures" used in the ActivityPub ecosystem, which is a different, incompatible scheme.