3 ms·
Sure. For example they could require you to sign the body of the HTTP request and put the signature in the HTTP "Authorization" header.
by jsiepkes 8y ago
Sure. For example they could require you to sign the body of the HTTP request and put the signature in the HTTP "Authorization" header.
- user5994461 8y agoThe Authorization header is where the authentication token goes. It's already used.
- nmadden 8y agoThere is a (now expired) draft for sending signed HTTP requests using JWS that includes the access token as part of the signature data getting around this problem. Edit: forgot the link https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03 https://tools.ietf.org/html/draft-ietf-oauth-signed-http-req...