mmo-ref/dep-curl
1
0
Fork 0
mirror of https://github.com/curl/curl synced 2026-08-25 12:32:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
dep-curl/docs/cmdline-opts/httpsig-algo.md
Sameeh Jubran a55731050e
httpsig: add RFC 9421 HTTP Message Signatures support 
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.

New libcurl options:
 - CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
 - CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
 - CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
 - CURLOPT_HTTPSIG_HEADERS: space-separated components to sign

New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers

The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.

Verified by test 5000 to 5021

Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
2026-07-25 16:25:37 +02:00

1.2 KiB
Raw Permalink Blame History

c SPDX-License-Identifier Long Protocols Arg Help Category Added Multi Experimental See-also Example
Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. curl httpsig-algo HTTP <algorithm> Algorithm for HTTP Message Signatures auth http 8.22.0 single yes
httpsig-key
httpsig-keyid
httpsig-headers
--httpsig-key key.hex --httpsig-keyid "my-key" $URL
--httpsig-algo hmac-sha256 --httpsig-key secret.hex --httpsig-keyid "shared" $URL

--httpsig-algo

Sign outgoing HTTP requests using RFC 9421 HTTP Message Signatures.

This option specifies which signing algorithm to use. Supported values are ed25519 and hmac-sha256. If not specified, ed25519 is used. Any other value causes curl to exit with an error.

HTTP Message Signatures are enabled when any of --httpsig-algo, --httpsig-key, --httpsig-keyid or --httpsig-headers is given. When enabled, --httpsig-key and --httpsig-keyid are required. Without any of these options no signing is performed.

By default, the signed components are method, authority, path, and query (when a query string is present). Use --httpsig-headers to override the set of components included in the signature.