Support for RFC 9421, HTTP Message Signatures
- Dominant language
- C#
- Stars
- 3.8k
- Forks
- 333
- Avg merge
- 16h 29m
- Merged PRs (30d)
- 116
Description
### Is your feature request related to a problem? Please describe the problem.
[RFC 9421 HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421) is a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message.
It is in use by [ActivityPub clients and servers](https://swicg.github.io/activitypub-http-signature/), like [Mastodon](https://github.com/mastodon/mastodon/issues/21429), and APIs using [RFC 9635 Grant Negotiation and Authorization Protocol (GNAP)](https://www.rfc-editor.org/rfc/rfc9635), like the [Open Payments API specification](https://openpayments.dev/introduction/overview/#grant-negotiation-and-authorization).
### Client library/SDK language
None
### Describe the solution you'd like
I would like a way for the generated SDKs to sign requests and verify responses, as specified by RFC 9421.
### Additional context
Similar request for [curl](https://github.com/curl/curl/discussions/13376)
Contributor guide
Research direction
Start by reading RFC 9421 and reviewing how generated SDKs currently create requests and verify responses. No files or entry points are identified in the issue; done would mean generated SDKs can sign requests and verify responses according to the RFC.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100