Replace http-message-sig with fetch-message-signatures in the web-bot-auth package - #122
Open
panva wants to merge 2 commits into
Open
Replace http-message-sig with fetch-message-signatures in the web-bot-auth package#122panva wants to merge 2 commits into
panva wants to merge 2 commits into
Conversation
The packages/http-message-sig package is unchanged, and is still built, tested and published from this repo. This is a breaking change for consumers of web-bot-auth. Signer is now a key identifier paired with a signer factory rather than a sign callback, and verify() takes a verifier factory in place of Verify<T>, which is removed along with SignerSync, SignOptions and SignSyncOptions. Directory.schema becomes optional. Every other export keeps its name, including signatureHeadersSync, directoryResponseHeaders, MediaType, Tag and HTTP_MESSAGE_SIGNATURES_DIRECTORY. One behaviour changes. RSA keys are validated for their digest as well as their algorithm, so verifier() rejects an RSA-PSS key created for SHA-256 rather than verifying with SHA-256 under a signature naming rsa-pss-sha512. Covered component matching is unchanged: both rules still match a field or derived component name whatever parameters the identifier carries. signatureHeadersSync composes createSignatureBase() and createSignatureFields(), neither of which returns a Promise. The IETF draft vectors now assert its Signature-Input byte for byte alongside the asynchronous path.
fetch-message-signatures exports the Structured Fields parser RFC 9421 is built on, so the separate structured-headers dependency is no longer needed here. packages/http-message-sig keeps its own. Values come back tagged rather than as raw JavaScript, so discoveryType reads a Token's text instead of relying on String() to produce it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@thibmeu 👋
I built fetch-message-signatures over the course of IETF 126 and finally wrapped it up today, an RFC 9421 implementation built for the Fetch API until it maybe one day supports it natively.
I ported
packages/web-bot-authonto it to test my own API against a real consumer. Opening the result here in case it's useful. If you'd rather keep your own implementation, feel free to close.Only
packages/web-bot-authchanges, I didn't touchpackages/http-message-sig. It also dropsstructured-headers, because the RFC 9651 parser comes fromfetch-message-signaturestoo.Two commits: the swap, then the
Signature-Agentparsing separately.Breaking for consumers:
Signeris now a key id plus a signer factory instead of a sign callback, andverify()takes a verifier factory instead ofVerify<T>.Verify<T>,SignerSync,SignOptionsandSignSyncOptionsare gone, andDirectory.schemais optional. Everything else keeps its name.Fixes: RSA keys are checked for their digest as well as their algorithm, so
verifier()rejects an RSA-PSS key made for SHA-256 rather than verifying with SHA-256 under a signature that saysrsa-pss-sha512.