cloudflare / cloudflare/cloudflare-docs

"Web Bot Auth" implementation guide is incorrect

Open
#30,968 5 comments 0 reactions 2 assignees Claimed by @jinhee-c-lee View on GitHub
content:edit documentation product:bots stale
Dominant language
MDX
Stars
5.2k
Forks
16.7k
Avg merge
2d 6h
Merged PRs (30d)
337

Description

### Existing documentation URL(s)

- https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/

### What changes are you suggesting?

https://github.com/cloudflare/cloudflare-docs/blob/production/src/content/docs/bots/reference/bot-verification/web-bot-auth.mdx

The page describes an outdated version of the [specification](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/). The new version contains a breaking change (https://github.com/thibmeu/http-message-signatures-directory/issues/70) that needs to be reflected in the implementation guide.

This guide is also linked from other websites ([example](https://shopify.dev/changelog/bots-and-agents-should-identify-themselves-via-web-bot-auth)) so it might be implemented incorrectly by others.

The main difference is that the `Signature-Agent` header changed from a string (`"https://signature-agent.test"` in the example) to a dictionary (`sig2="https://signature-agent.test"`, based on the example)

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.