httpsignatures-go icon indicating copy to clipboard operation
httpsignatures-go copied to clipboard

Missing `Host` header causes signature mismatch

Open v-yarotsky opened this issue 8 years ago • 0 comments

The 7th draft of the "Signing HTTP Messages" spec recommends the use of the Host header when calculating a signature. However, it looks like Request from net/http removes Host from the headers and instead makes it available on the Request structure itself.

Example:

&http.Request{
  Method:"GET",
  URL:(*url.URL)(0xc42010d100),
  Proto:"HTTP/1.1",
  ProtoMajor:1,
  ProtoMinor:1,
  Header:http.Header{
    "Date":[]string{"Tue, 03 Oct 2017 23:18:06 GMT"},
    "Accept-Encoding":[]string{"gzip;q=1.0,deflate;q=0.6,identity;q=0.3"},
    "Signature":[]string{"keyId=\"key1\",algorithm=\"hmac-sha256\",headers=\"(request-target) host date\",signature=\"T09YOpz+vN+VltcLRok8NgZSVSgm4W6EhjRUNwX7JXQ=\""},
    "Connection":[]string{"keep-alive"},
    "Keep-Alive":[]string{"30"},
    "Accept":[]string{"application/x-msgpack"},
    "User-Agent":[]string{"The Client"}
  },
  Body:http.noBody{},
  GetBody:(func() (io.ReadCloser, error))(nil),
  ContentLength:0,
  TransferEncoding:[]string(nil),
  Close:false,
  Host:"localhost:3500",
  Form:url.Values(nil),
  PostForm:url.Values(nil),
  MultipartForm:(*multipart.Form)(nil),
  Trailer:http.Header(nil),
  RemoteAddr:"[::1]:53522",
  RequestURI:"/v1/files?ids%5B%5D=1",
  TLS:(*tls.ConnectionState)(nil),
  Cancel:(<-chan struct {})(nil),
  Response:(*http.Response)(nil),
  ctx:(*context.cancelCtx)(0xc4201ff8c0)
}

Should the Host header be special-cased?

v-yarotsky avatar Oct 03 '17 23:10 v-yarotsky