Verifies RFC 9421 signatures on incoming requests.
plug MessageSignatures.Plug,
key_resolver: MyApp.KeyResolver,
policy: [required_components: ["@method", "@target-uri", "content-digest"]]On success the MessageSignatures.VerifyResult lands in
conn.assigns[:message_signature]. On failure the connection halts
with 400 for malformed input or 401 for other verification errors;
override the response with :on_failure.
This plug verifies the signature, including a covered content-digest
header. Verifying that the digest matches the request body is a separate
layer. Compose HTTPDigest.Plug from the http_digest package before
this plug so each layer verifies its own concern:
plug Plug.Parsers,
parsers: [:json],
json_decoder: JSON,
body_reader: {HTTPDigest.Plug, :read_body, []}
plug HTTPDigest.Plug, required: true
plug MessageSignatures.Plug,
key_resolver: MyApp.KeyResolver,
policy: [required_components: ["@method", "@target-uri", "content-digest"]]