Amazon's protocols were clearly designed by a Java EE developer. Not that there isn't anything inherently wrong with them, and they are very flexible. They're a

Amazon's protocols were clearly designed by a Java EE developer. Not that there isn't anything inherently wrong with them, and they are very flexible. They're also somewhat stuck with them based around the huge amount of code which interfaces with S3/AWS. There are some problems with no good solution, namely the signed parameters in Amazon's case. How do you sign JSON? Is there a "canonical" JSON format that will allow signing consistently, and verification? All the approaches I've seen are incompatible in some way. Client-side SSL is another solution, but its much less flexible (i.e., token-generated requests wouldn't be easy)