mirror of
https://github.com/curl/curl
synced 2026-08-25 12:32:35 -04:00
46 lines
1.4 KiB
Markdown
46 lines
1.4 KiB
Markdown
|
---
|
||
|
|
c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
|
||
|
|
SPDX-License-Identifier: curl
|
||
|
|
Long: httpsig-headers
|
||
|
|
Protocols: HTTP
|
||
|
|
Arg: <components>
|
||
|
|
Help: Components to sign for HTTP Message Signatures
|
||
|
|
Category: auth http
|
||
|
|
Added: 8.22.0
|
||
|
|
Multi: single
|
||
|
|
Experimental: yes
|
||
|
|
See-also:
|
||
|
|
- httpsig-algo
|
||
|
|
- httpsig-key
|
||
|
|
- httpsig-keyid
|
||
|
|
Example:
|
||
|
|
- --httpsig-algo ed25519 --httpsig-key key.hex --httpsig-keyid "my-key" --httpsig-headers "method authority content-type:" $URL
|
||
|
|
---
|
||
|
|
|
||
|
|
# `--httpsig-headers`
|
||
|
|
|
||
|
|
Space-separated list of components to include in the RFC 9421 HTTP Message
|
||
|
|
Signature. Derived components are given as bare names: `method`, `authority`,
|
||
|
|
`path`, and `query`. HTTP header fields are given with a trailing colon, for
|
||
|
|
example `content-type:` and `content-digest:`.
|
||
|
|
|
||
|
|
If not specified, the default set is `method authority path` (plus `query`
|
||
|
|
when a query string is present in the URL).
|
||
|
|
|
||
|
|
## Signing request headers
|
||
|
|
|
||
|
|
Header components are taken from `-H` / `--header` options only. Headers curl
|
||
|
|
adds by default (such as `User-Agent`) are not signed unless you set them
|
||
|
|
explicitly, for example:
|
||
|
|
|
||
|
|
curl --httpsig-algo ed25519 \
|
||
|
|
--httpsig-key k.hex \
|
||
|
|
--httpsig-keyid mykey \
|
||
|
|
-H "User-Agent: MyApp/1.0" \
|
||
|
|
--httpsig-headers \
|
||
|
|
"method authority path user-agent:" \
|
||
|
|
$URL
|
||
|
|
|
||
|
|
Each component may appear only once. Duplicate identifiers in
|
||
|
|
`--httpsig-headers` cause curl to exit with an error.
|