HTTPSign v0.1.0 HTTPSign.Verifier

[2.5. Verifying a Signature]

(https://tools.ietf.org/id/draft-cavage-http-signatures-09.html#verify)

In order to verify a signature, a server MUST:

  1. Use the received HTTP message, the headers value, and the Signature String Construction algorithm to recreate the signature string.

  2. The algorithm, keyId, and base 64 decoded signature listed in the signature parameters are then used to verify the authenticity of the digital signature.

For example, assume that the algorithm value was “rsa-sha256”. This would signal to the application that the data associated with keyId is an RSA Public Key (as defined in [RFC3447]), the signature string hashing function is SHA-256, and the signature verification algorithm to use to verify the signature is the one defined in [RFC3447], Section 8.2.2. The result of the signature verification algorithm specified in [RFC3447] should result in a successful verification unless the headers protected by the signature were tampered with in transit.

[Appendix A. Security Considerations]

(https://tools.ietf.org/id/draft-cavage-http-signatures-09.html#rfc.appendix.A)

There are a number of security considerations to take into account when implementing or utilizing this specification. A thorough security analysis of this protocol, including its strengths and weaknesses, can be found in [Security Considerations for HTTP Signatures] (https://web-payments.org/specs/source/http-signatures-audit/).

Link to this section Summary

Functions

Verify the signature of the HTTP request signature

Link to this section Functions

Link to this function verify(conn, key)
verify(Plug.Conn.t(), binary()) ::
  {:ok, Plug.Conn.t()} | {:error, atom() | binary()}

Verify the signature of the HTTP request signature.