HTTPSign v0.1.0 HTTPSign.Verifier
[2.5. Verifying a Signature]
(https://tools.ietf.org/id/draft-cavage-http-signatures-09.html#verify)
In order to verify a signature, a server MUST:
Use the received HTTP message, the
headers
value, and the Signature String Construction algorithm to recreate the signature string.The
algorithm
,keyId
, and base 64 decodedsignature
listed in the signature parameters are then used to verify the authenticity of the digital signature.
For example, assume that the algorithm
value was “rsa-sha256”. This would
signal to the application that the data associated with keyId
is an RSA
Public Key (as defined in [RFC3447]), the signature string hashing function
is SHA-256, and the signature
verification algorithm to use to verify the
signature is the one defined in [RFC3447], Section 8.2.2. The result of the
signature verification algorithm specified in [RFC3447] should result in a
successful verification unless the headers protected by the signature were
tampered with in transit.
[Appendix A. Security Considerations]
(https://tools.ietf.org/id/draft-cavage-http-signatures-09.html#rfc.appendix.A)
There are a number of security considerations to take into account when implementing or utilizing this specification. A thorough security analysis of this protocol, including its strengths and weaknesses, can be found in [Security Considerations for HTTP Signatures] (https://web-payments.org/specs/source/http-signatures-audit/).
Link to this section Summary
Functions
Verify the signature of the HTTP request signature
Link to this section Functions
verify(Plug.Conn.t(), binary()) :: {:ok, Plug.Conn.t()} | {:error, atom() | binary()}
Verify the signature of the HTTP request signature.