mirror of
https://github.com/curl/curl
synced 2026-08-25 12:32:35 -04:00
a55731050e
Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.
New libcurl options:
- CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
- CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
- CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
- CURLOPT_HTTPSIG_HEADERS: space-separated components to sign
New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers
The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.
Verified by test 5000 to 5021
Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239
45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
---
|
|
c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
SPDX-License-Identifier: curl
|
|
Long: httpsig-headers
|
|
Protocols: HTTP
|
|
Arg: <components>
|
|
Help: Components to sign for HTTP Message Signatures
|
|
Category: auth http
|
|
Added: 8.22.0
|
|
Multi: single
|
|
Experimental: yes
|
|
See-also:
|
|
- httpsig-algo
|
|
- httpsig-key
|
|
- httpsig-keyid
|
|
Example:
|
|
- --httpsig-algo ed25519 --httpsig-key key.hex --httpsig-keyid "my-key" --httpsig-headers "method authority content-type:" $URL
|
|
---
|
|
|
|
# `--httpsig-headers`
|
|
|
|
Space-separated list of components to include in the RFC 9421 HTTP Message
|
|
Signature. Derived components are given as bare names: `method`, `authority`,
|
|
`path`, and `query`. HTTP header fields are given with a trailing colon, for
|
|
example `content-type:` and `content-digest:`.
|
|
|
|
If not specified, the default set is `method authority path` (plus `query`
|
|
when a query string is present in the URL).
|
|
|
|
## Signing request headers
|
|
|
|
Header components are taken from `-H` / `--header` options only. Headers curl
|
|
adds by default (such as `User-Agent`) are not signed unless you set them
|
|
explicitly, for example:
|
|
|
|
curl --httpsig-algo ed25519 \
|
|
--httpsig-key k.hex \
|
|
--httpsig-keyid mykey \
|
|
-H "User-Agent: MyApp/1.0" \
|
|
--httpsig-headers \
|
|
"method authority path user-agent:" \
|
|
$URL
|
|
|
|
Each component may appear only once. Duplicate identifiers in
|
|
`--httpsig-headers` cause curl to exit with an error.
|