mirror of https://github.com/curl/curl synced 2026-08-25 12:32:35 -04:00

httpsig: add RFC 9421 HTTP Message Signatures support

Add support for signing outgoing HTTP requests per RFC 9421 using
Ed25519 or HMAC-SHA256 algorithms.

New libcurl options:
 - CURLOPT_HTTPSIG: signing algorithm ("ed25519" or "hmac-sha256")
 - CURLOPT_HTTPSIG_KEY: path to hex-encoded key file
 - CURLOPT_HTTPSIG_KEYID: key identifier for Signature-Input
 - CURLOPT_HTTPSIG_HEADERS: space-separated components to sign

New CLI flags: --httpsig, --httpsig-key, --httpsig-keyid,
--httpsig-headers

The crypto layer follows the sha256.c multi-backend pattern with
implementations for OpenSSL (EVP_DigestSign) and wolfSSL
(wc_ed25519_sign_msg). HMAC-SHA256 uses the existing Curl_hmacit()
infrastructure which works on all backends.

Verified by test 5000 to 5021

Assisted-by: Daniel Stenberg
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Closes #22386
Closes #21239

2026-07-25 16:25:37 +02:00

1.8 KiB

Raw Blame History

SPDX-License-Identifier

Title

Section

Source

See-also

Protocol

Added-in

curl

CURLOPT_HTTPSIG_KEYID

libcurl

CURLOPT_HTTPSIG_ALGORITHM (3)

CURLOPT_HTTPSIG_KEY (3)

HTTP

8.22.0

NAME

CURLOPT_HTTPSIG_KEYID - key identifier for HTTP Message Signatures

SYNOPSIS

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPSIG_KEYID, char *keyid);

DESCRIPTION

This feature is experimental and may change before it is considered stable. We advise against using it in production.

Pass a null-terminated string that identifies the key used for RFC 9421 HTTP Message Signatures. This value is included as the keyid parameter in the Signature-Input header, allowing the server to look up the corresponding verification key.

The application does not have to keep the string around after setting this option.

Using this option multiple times makes the last set string override the previous ones. Set it to NULL to disable its use again.

DEFAULT

NULL

%PROTOCOLS%

EXAMPLE

int main(void)
{
  CURL *curl = curl_easy_init();

  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/api");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_ALGORITHM,
                     CURLHTTPSIG_ED25519);
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEY,
                     "9f8362f87a484a954e6e740c5b4c0e84"
                     "229139a20aa8ab56ff66586f6a7d29c5");
    curl_easy_setopt(curl, CURLOPT_HTTPSIG_KEYID, "my-key-id");
    curl_easy_perform(curl);
  }
}

%AVAILABILITY%

RETURN VALUE

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3).

1.8 KiB Raw Blame History