A better write-up can be found on GitHub: https://github.com/joyent/node-http-signature/blob/master/http_signing.md https://github.com/joyent/node-http-signatur

A better write-up can be found on GitHub: https://github.com/joyent/node-http-signature/blob/master/http_signing.md https://github.com/joyent/node-http-signature/blob/master/ht... Frankly, the blog post leaves a lot of questions and is short on links to answers. It would be easy to walk away from the post thinking Joyent's HTTP Signatures to be incompetently designed. It was almost enough to have me quip, "More like HTTPS Signatures," because the design in the blog post is only sensible over TLS. However, having found the above link, I see that it is the defaults that assume TLS, but that you can specify the signature contain all headers and the request line. This makes it possible to sign requests over HTTP. I'd rather the defaults be reasonable for insecure transports (i.e., all headers + 'request-line'), since the TLS case is easily handled with just 'headers="date"'. If that's not to happen, I'd hope that implementations actively prevent the use of the defaults over insecure transports. Unfortunately, Joyent's reference implementation doesn't seem to do this.