HTTP Message Signatures

This library provides a simple way to implement the IETF HTTP Message Signatures draft standard for signing and verifying the integrity and authenticity of HTTP requests and responses.

HTTP Message Signatures provide a secure way to ensure that HTTP messages exchanged between clients and servers are authentic and have not been tampered with during transit.

The library does not provide any cryptographic functionality, but instead relies on the user to provide Signer and Verify callback functions for signing and verifying messages, respectively. This allows you to choose your preferred cryptographic library and signing algorithm.

This library can be used both in Node.js and the browser, and the documentation provides platform-specific examples for each environment.

Clarification

This library almost completely copies the code from this repository (https://github.com/ltonetwork/http-message-signatures). My intention with this repository is only to practice and understand how the procedure of signing an HTTP request works, if you want stable code, please go to the original repository

Usage

Signing

import { sign } from 'ietf-httpbis-msg-signatures';

const signer = { 
  keyid: 'test-key',
  alg: 'hmac-sha256',
  sign: (data) => {
    // ... Sign the data using your preferred cryptographic library
  }
};

const request = {
  method: 'POST',
  url: 'https://example.com/api/data',
  headers: {
    'Content-Type': 'application/json',
    'Digest': 'sha-256=4VYMyeX0tNLQ7opuAJeMECP3HgfLswAG3n+IqQprO0Q=',
  }
};


(async () => {
    const signedRequest = await sign(request, { signer });
    // ... Send the signed request to the server
})();

Verification

import { verify } from 'ietf-httpbis-msg-signatures';

const verifyCallback = async (data, signature, params) => {
  const account = await getAccount(params.keyid);

  // ... Verify the signature using your preferred cryptographic library
  if (!valid) throw new Error('Invalid signature');
  
  return account;
};


const request = {
  method: 'POST',
  url: 'https://example.com/api/data',
  headers: {
    'Content-Type': 'application/json',
    'Digest': 'sha-256=4VYMyeX0tNLQ7opuAJeMECP3HgfLswAG3n+IqQprO0Q=',
    'Signature': 'keyid="test-key",algorithm="hmac-sha256",signature="base64encodedsignature"',
    'Signature-Input': 'sig1=("@method" "@path" "@authority" "content-type" "digest");created=1618884475'
  }
};

(async () => {
  try {
    const verified = await verify(request, verifyCallback);
    console.log('Verification succeeded');
  } catch (err) {
    console.error('Verification failed:', err.message);
  }
})();