2 ms·
mtls is problematic because it is not proxy friendly (needs special support in the frontmost proxy). AWS and Mastodon use HTTP request signing which seems inte
by remram 5y ago
mtls is problematic because it is not proxy friendly (needs special support in the frontmost proxy).
AWS and Mastodon use HTTP request signing which seems interesting.
- bbtcyyzv 5y agoI think HTTP request signing will be a non-starter for an interoperable standard like oauth because of the difficulty of canonicalization without an authoritative library. AWS can pull that off because they have an SDK that will canonicalize requests for you, and it's tested in lockstep with the server accepting it. Historically, XML (and JSON to a lesser extent) have been security minefields for this exact reason.
- varanauskas 5y agoAFAIK according the draft HTTP request signing rfc [1] defines explicit instructions for normalising, serialising and signing HTTP headers (not body). However, you can use an HTTP Digest header for example, that is a hash of the plaintext body to authenticate the body [1] https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-message-signatures https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-mes...