mirror of
https://github.com/curl/curl
synced 2026-08-25 12:32:35 -04:00
a55731050e
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
1.4 KiB
1.4 KiB
| c | SPDX-License-Identifier | Long | Protocols | Arg | Help | Category | Added | Multi | Experimental | See-also | Example | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. | curl | httpsig-headers | HTTP | <components> | Components to sign for HTTP Message Signatures | auth http | 8.22.0 | single | yes |
|
|
--httpsig-headers
Space-separated list of components to include in the RFC 9421 HTTP Message
Signature. Derived components are given as bare names: method, authority,
path, and query. HTTP header fields are given with a trailing colon, for
example content-type: and content-digest:.
If not specified, the default set is method authority path (plus query
when a query string is present in the URL).
Signing request headers
Header components are taken from -H / --header options only. Headers curl
adds by default (such as User-Agent) are not signed unless you set them
explicitly, for example:
curl --httpsig-algo ed25519 \
--httpsig-key k.hex \
--httpsig-keyid mykey \
-H "User-Agent: MyApp/1.0" \
--httpsig-headers \
"method authority path user-agent:" \
$URL
Each component may appear only once. Duplicate identifiers in
--httpsig-headers cause curl to exit with an error.