Skip to content

Commit f043d04

Browse files
sp1ffsp1ff
authored
fix(picky)!: comply with draft-cavage-http-signatures-12 when signing HTTP messages (#351)
BREAKING CHANGE: Change request target handling to comply with draft-cavage-http-signatures-12 when signing HTTP messages.
1 parent f3550ea commit f043d04

File tree

2 files changed

+34
-35
lines changed

2 files changed

+34
-35
lines changed

‎picky/src/http/http_signature.rs‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -555,6 +555,9 @@ impl<'a> HttpSignatureBuilder<'a> {
555555
let key = split.next().expect("there is always at least one element in the split");
556556
if let Some(value) = split.next() {
557557
match key {
558+
Header::REQUEST_TARGET_STR => {
559+
headers.push(Header::RequestTarget);
560+
}
558561
Header::CREATED_STR => {
559562
headers.push(Header::Created);
560563
created = Some(value.trim().parse().map_err(|_| {
@@ -569,12 +572,6 @@ impl<'a> HttpSignatureBuilder<'a> {
569572
}
570573
header_name => headers.push(Header::new_name(header_name.to_owned())),
571574
}
572-
} else if key.starts_with("get")
573-
|| key.starts_with("post")
574-
|| key.starts_with("put")
575-
|| key.starts_with("delete")
576-
{
577-
headers.push(Header::RequestTarget);
578575
} else {
579576
return Err(HttpSignatureError::InvalidSigningString { line: line.to_owned() });
580577
}
@@ -603,7 +600,8 @@ impl<'a> HttpSignatureBuilder<'a> {
603600
}
604601
Header::RequestTarget => {
605602
acc.push(format!(
606-
"{} {}",
603+
"{}: {} {}",
604+
header.as_str(),
607605
http_request.get_lowercased_method()?,
608606
http_request.get_target()?
609607
));
@@ -771,7 +769,8 @@ impl<'a> HttpSignatureVerifier<'a> {
771769
}
772770
Header::RequestTarget => {
773771
acc.push(format!(
774-
"{} {}",
772+
"{}: {} {}",
773+
header.as_str(),
775774
http_request.get_lowercased_method()?,
776775
http_request.get_target()?
777776
));
@@ -914,20 +913,20 @@ mod tests {
914913
use picky_asn1_x509::{AlgorithmIdentifier, SubjectPublicKeyInfo};
915914

916915
const HTTP_SIGNATURE_EXAMPLE: &str = "Signature keyId=\"my-rsa-key\",algorithm=\"rsa-sha256\"\
917-
,created=1402170695,headers=\"(request-target) (created) date\",\
918-
signature=\"CM3Ui6l4Z6+yYdWaX5Cz10OAqUceS53Zy/qA+e4xG5Nabe215iTlnj/sfVJ3nBaMIOj/4e\
919-
gxTKNDXAJbLm6nOF8zUOdJBuKQZNO1mfzrMKLsz7gc2PQI1eVxGNJoBZ40L7CouertpowQFpKyizNXqH/y\
920-
YBgqPEnLk+p5ISkXeHd7P/YbAAQGnSe3hnJ/gkkJ5rS6mGuu2C8+Qm68tcSGz9qwVdNTFPpji5VPxprs2J\
921-
2Z1vjsMVW97rsKOs8lo+qxPGfni27udledH2ZQABGZHOgZsChj59Xb3oVAA8/V3rjt5Un7gsz2AHQ6aY6o\
922-
ky59Rsg/CpB8gP7szjK/wrCclA==\"";
916+
,created=1402170695,headers=\"(request-target) (created) date\",\
917+
signature=\"bw579lDtTDsp7zif/F7Fy93KXrM6qUfCb43JMJtiL4+3nazIPlxcxVsRJEgZzK/QQPDoeUQ\
918+
p4BYCzi2CbthYhHJMn/Wv008gNMcQQTuEw/KcnMrFWxqqUnVZQbCQvNai2y80WrBiOFZvN2VIdLUSO4SoIa\
919+
OHvrvEoQhl3sqpv1z7yCVbQtJHwnPOWoy/11p+SU3X2ARJXN555q5wSn+DykM0Ohq1cXD84MHXP5ulI0Fa8\
920+
4zQ5waxoXsieex4FI+zXSlngGmchBPXMUC437u2wXA1zLA4KGUL/uNScL1MKrTMqgV0MK4o6sR0LHOqHmIi\
921+
MJ7h++UmOW/0Iw74CL2UGQ==\"";
923922

924923
const HTTP_SIGNATURE_WEIRD_FORMAT: &str = "Signature keyId = my-rsa-key ,created= \"1402170695\",\
925-
,algorithm =\"rsa-sha256 \",headers=(request-target) (created) date ,\
926-
signature=CM3Ui6l4Z6+yYdWaX5Cz10OAqUceS53Zy/qA+e4xG5Nabe215iTlnj/sfVJ3nBaMIOj/4e\
927-
gxTKNDXAJbLm6nOF8zUOdJBuKQZNO1mfzrMKLsz7gc2PQI1eVxGNJoBZ40L7CouertpowQFpKyizNXqH/y\
928-
YBgqPEnLk+p5ISkXeHd7P/YbAAQGnSe3hnJ/gkkJ5rS6mGuu2C8+Qm68tcSGz9qwVdNTFPpji5VPxprs2J\
929-
2Z1vjsMVW97rsKOs8lo+qxPGfni27udledH2ZQABGZHOgZsChj59Xb3oVAA8/V3rjt5Un7gsz2AHQ6aY6o\
930-
ky59Rsg/CpB8gP7szjK/wrCclA==";
924+
,algorithm =\"rsa-sha256 \",headers=(request-target) (created) date ,\
925+
signature=bw579lDtTDsp7zif/F7Fy93KXrM6qUfCb43JMJtiL4+3nazIPlxcxVsRJEgZzK/QQPDoeUQ\
926+
p4BYCzi2CbthYhHJMn/Wv008gNMcQQTuEw/KcnMrFWxqqUnVZQbCQvNai2y80WrBiOFZvN2VIdLUSO4SoIa\
927+
OHvrvEoQhl3sqpv1z7yCVbQtJHwnPOWoy/11p+SU3X2ARJXN555q5wSn+DykM0Ohq1cXD84MHXP5ulI0Fa8\
928+
4zQ5waxoXsieex4FI+zXSlngGmchBPXMUC437u2wXA1zLA4KGUL/uNScL1MKrTMqgV0MK4o6sR0LHOqHmIi\
929+
MJ7h++UmOW/0Iw74CL2UGQ==";
931930

932931
fn private_key_1() -> PrivateKey {
933932
let pem = picky_test_data::RSA_2048_PK_7.parse::<Pem>().expect("pem 1");
@@ -1136,7 +1135,7 @@ mod tests {
11361135

11371136
#[test]
11381137
fn sign_with_pre_generated_signing_string() {
1139-
let signing_string = "get /foo\n(created): 1402170695\ndate: Tue, 07 Jun 2014 20:51:35 GMT";
1138+
let signing_string = "(request-target): get /foo\n(created): 1402170695\ndate: Tue, 07 Jun 2014 20:51:35 GMT";
11401139
let http_signature = HttpSignatureBuilder::new()
11411140
.key_id("my-rsa-key")
11421141
.signature_method(
@@ -1152,7 +1151,7 @@ mod tests {
11521151

11531152
#[test]
11541153
fn verify_with_pre_generated_signing_string() {
1155-
let signing_string = "get /foo\n(created): 1402170695\ndate: Tue, 07 Jun 2014 20:51:35 GMT";
1154+
let signing_string = "(request-target): get /foo\n(created): 1402170695\ndate: Tue, 07 Jun 2014 20:51:35 GMT";
11561155
let http_signature = HttpSignature::from_str(HTTP_SIGNATURE_EXAMPLE).expect("http signature");
11571156
http_signature
11581157
.verifier()
@@ -1168,7 +1167,7 @@ mod tests {
11681167

11691168
#[test]
11701169
fn verify_with_leeway() {
1171-
let signing_string = "get /foo\n(created): 1402170695\ndate: Tue, 07 Jun 2014 20:51:35 GMT";
1170+
let signing_string = "(request-target): get /foo\n(created): 1402170695\ndate: Tue, 07 Jun 2014 20:51:35 GMT";
11721171
let http_signature = HttpSignature::from_str(HTTP_SIGNATURE_EXAMPLE).expect("http signature");
11731172
http_signature
11741173
.verifier()
@@ -1207,12 +1206,12 @@ mod tests {
12071206
}
12081207

12091208
const HTTP_SIGNATURE_LEGACY: &str = "Signature keyId=my-rsa-key,created=1402170695,\
1210-
headers=(request-target) (created) date,\
1211-
signature=CM3Ui6l4Z6-yYdWaX5Cz10OAqUceS53Zy_qA-e4xG5Nabe215iTlnj_sfVJ3nBaMIOj_4e\
1212-
gxTKNDXAJbLm6nOF8zUOdJBuKQZNO1mfzrMKLsz7gc2PQI1eVxGNJoBZ40L7CouertpowQFpKyizNXqH_y\
1213-
YBgqPEnLk-p5ISkXeHd7P_YbAAQGnSe3hnJ_gkkJ5rS6mGuu2C8-Qm68tcSGz9qwVdNTFPpji5VPxprs2J\
1214-
2Z1vjsMVW97rsKOs8lo-qxPGfni27udledH2ZQABGZHOgZsChj59Xb3oVAA8_V3rjt5Un7gsz2AHQ6aY6o\
1215-
ky59Rsg_CpB8gP7szjK_wrCclA";
1209+
headers=(request-target) (created) date,\
1210+
signature=bw579lDtTDsp7zif_F7Fy93KXrM6qUfCb43JMJtiL4-3nazIPlxcxVsRJEgZzK_QQPDoeUQp4B\
1211+
YCzi2CbthYhHJMn_Wv008gNMcQQTuEw_KcnMrFWxqqUnVZQbCQvNai2y80WrBiOFZvN2VIdLUSO4SoIaOHvr\
1212+
vEoQhl3sqpv1z7yCVbQtJHwnPOWoy_11p-SU3X2ARJXN555q5wSn-DykM0Ohq1cXD84MHXP5ulI0Fa84zQ5w\
1213+
axoXsieex4FI-zXSlngGmchBPXMUC437u2wXA1zLA4KGUL_uNScL1MKrTMqgV0MK4o6sR0LHOqHmIiMJ7h--\
1214+
UmOW_0Iw74CL2UGQ";
12161215

12171216
#[test]
12181217
fn legacy() {

‎picky/src/http/mod.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -84,11 +84,11 @@
8484
//! http_signature_str,
8585
//! "Signature keyId=\"my-rsa-key\",algorithm=\"rsa-sha224\",created=1402170695,\
8686
//! headers=\"(request-target) (created) host date cache-control x-emptyheader x-example\",\
87-
//! signature=\"QwuxxMSuvCdA5a2cDOjg+1WFEEGa/gD8fWwKm7gah4IUCssrie+bA5sp9wH7Jz8TQYh/XNDRUHKc\
88-
//! 0oziBAIy1CsfDQWGRM+pAonfXEJufdt07v/i0OFhj5rBJfoOWPUcJ0cXzu0gs6svNhvimS3h2g30\
89-
//! gsnw1+Qjgv0+5HFwqZH4i+bHzaj0r9vIZZnnk3ecg8O2uOLuG5jCszJU9SBA0ug8l/NrQPJXMhCO\
90-
//! X59HkNVCkT4TPOovNZHyJQwu8IDhba0evPTCIvrzULpN4qY+ZAua2i3wGwWqFUgbm4eBJS2pwjWr\
91-
//! XyRusoELK0BjJ8a0KdOegmbEViIxy/Uqu0L2yQ==\""
87+
//! signature=\"JueyecQbV5rQ3TI1EfqZRjAZMMOb4ABZNS0yDcBDgyfbOLORYipT2An2MCH8n/HequVJkEE\
88+
//! 86/vj9ZFLbyqFkV3a8uQGB6gaE79l9YNdzVeO5k7GBb1jskwBXnqVtGmn8aT2f+cJzkDtu6ptg+UtaU\
89+
//! ZOQKdutc8aHq1NCLwvqMbA410XP0pA5r/VTbMg/yW8rHguue0Trh0WYCw8zHfNuZtheWxvWGLdYxvC0\
90+
//! u5oJA0PdxFceqVd/304+RQsrDGLtX8J9vSeqEsQJfvswFyMTkdl1gDbP/YdXp7ADzc2D9IefT9zqvFd\
91+
//! yEDDXEXKmZm+22395xRtnFmeWXu/+PM6wg==\""
9292
//! );
9393
//!
9494
//! // parse a http signature and verify it
@@ -108,7 +108,7 @@
108108
//! // alternatively you can provide a pre-generated signing string
109109
//!
110110
//! let signing_string =
111-
//! "get /foo\n\
111+
//! "(request-target): get /foo\n\
112112
//! (created): 1402170695\n\
113113
//! host: example.org\n\
114114
//! date: Tue, 07 Jun 2014 20:51:35 GMT\n\

0 commit comments

Comments
 (0)