httpsignatures-go
httpsignatures-go copied to clipboard
Missing `Host` header causes signature mismatch
The 7th draft of the "Signing HTTP Messages" spec recommends the use of the Host header when calculating a signature.
However, it looks like Request from net/http removes Host from the headers and instead makes it available on the Request structure itself.
Example:
&http.Request{
Method:"GET",
URL:(*url.URL)(0xc42010d100),
Proto:"HTTP/1.1",
ProtoMajor:1,
ProtoMinor:1,
Header:http.Header{
"Date":[]string{"Tue, 03 Oct 2017 23:18:06 GMT"},
"Accept-Encoding":[]string{"gzip;q=1.0,deflate;q=0.6,identity;q=0.3"},
"Signature":[]string{"keyId=\"key1\",algorithm=\"hmac-sha256\",headers=\"(request-target) host date\",signature=\"T09YOpz+vN+VltcLRok8NgZSVSgm4W6EhjRUNwX7JXQ=\""},
"Connection":[]string{"keep-alive"},
"Keep-Alive":[]string{"30"},
"Accept":[]string{"application/x-msgpack"},
"User-Agent":[]string{"The Client"}
},
Body:http.noBody{},
GetBody:(func() (io.ReadCloser, error))(nil),
ContentLength:0,
TransferEncoding:[]string(nil),
Close:false,
Host:"localhost:3500",
Form:url.Values(nil),
PostForm:url.Values(nil),
MultipartForm:(*multipart.Form)(nil),
Trailer:http.Header(nil),
RemoteAddr:"[::1]:53522",
RequestURI:"/v1/files?ids%5B%5D=1",
TLS:(*tls.ConnectionState)(nil),
Cancel:(<-chan struct {})(nil),
Response:(*http.Response)(nil),
ctx:(*context.cancelCtx)(0xc4201ff8c0)
}
Should the Host header be special-cased?