Issue with http sig request/response binding

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2023-02-15

As Justin brought up on today’s call, there is an issue with the way we use http sig:

https://lists.w3.org/Archives/Public/ietf-http-wg/2023JanMar/0063.html

in particular this text from FAPI2 Message Signing:

1. shall cryptographically link the response to the request by including the request signature in the response signature input by means of the `req` boolean flag defined in 2.4 in [!I-D.ietf-httpbis-message-signatures] on the signature field of the request that caused the response

‌

---

Bitbucket status: resolved

Bitbucket origin: issue 575

[bitbucket-import-issues]

Originally submitted by jricher_authlete (Justin Richer) on 2023-02-22

To mitigate this, the response should really just sign all of the request components that are required. This list could easily be taken from the requirements for signing requests in the first place, something like “method, target-uri, content-digest if applicable”, along with signing “signature and signature-input” as well won’t hurt, they just can’t be relied on for the transitive protection.

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2023-03-01

https://bitbucket.org/openid/fapi/pull-requests/411

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2023-03-08

we’ve temporarily removed the http signature section, but will add back in once the issue is resolved in the core IETF spec

[bitbucket-import-issues]

Originally submitted by jricher_authlete (Justin Richer) on 2023-03-08

This is the PR on the IETF spec: httpwg/http-extensions#2452

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2023-10-10

issue already resolved