4 ms·
HTTP Signatures
- amingilani 10y agoThis is certainly one API authentication scheme that doesn't get much coverage. Over JWTs: this allows individual token revocation, data integrity checks and is resistant to replay attacks. I wish more APIs used this.
- XtalJ 10y agoHTTPS is often overkill because it encrypts everything, which isn't always necessary for websites/pages with non-personal data. Then it is sufficient enough to just sign it. Maybe the key could be distributed through DNS, like DKIM.
- brudgers 10y agoThe draft expired in April.