99designs / 99designs/httpsignatures-go

Missing `Host` header causes signature mismatch

未关闭
#10 0 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Go
星标
28
派生
15
PR 合并指标
30 天内没有已合并 PR

描述

The 7th draft of the "Signing HTTP Messages" spec [recommends](https://tools.ietf.org/html/draft-cavage-http-signatures-07#appendix-C.2) the use of the `Host` header when calculating a signature.
However, it looks like `Request` from `net/http` removes `Host` from the headers and instead makes it available on the `Request` structure itself.

Example:
```
&http.Request{
Method:"GET",
URL:(*url.URL)(0xc42010d100),
Proto:"HTTP/1.1",
ProtoMajor:1,
ProtoMinor:1,
Header:http.Header{
"Date":[]string{"Tue, 03 Oct 2017 23:18:06 GMT"},
"Accept-Encoding":[]string{"gzip;q=1.0,deflate;q=0.6,identity;q=0.3"},
"Signature":[]string{"keyId=\"key1\",algorithm=\"hmac-sha256\",headers=\"(request-target) host date\",signature=\"T09YOpz+vN+VltcLRok8NgZSVSgm4W6EhjRUNwX7JXQ=\""},
"Connection":[]string{"keep-alive"},
"Keep-Alive":[]string{"30"},
"Accept":[]string{"application/x-msgpack"},
"User-Agent":[]string{"The Client"}
},
Body:http.noBody{},
GetBody:(func() (io.ReadCloser, error))(nil),
ContentLength:0,
TransferEncoding:[]string(nil),
Close:false,
Host:"localhost:3500",
Form:url.Values(nil),
PostForm:url.Values(nil),
MultipartForm:(*multipart.Form)(nil),
Trailer:http.Header(nil),
RemoteAddr:"[::1]:53522",
RequestURI:"/v1/files?ids%5B%5D=1",
TLS:(*tls.ConnectionState)(nil),
Cancel:(<-chan struct {})(nil),
Response:(*http.Response)(nil),
ctx:(*context.cancelCtx)(0xc4201ff8c0)
}
```
Should the `Host` header be special-cased?

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。