https://nalar.dev/tags/signatures/ Recent content in Signatures on Nalar Hugo en-us Thu, 24 Sep 2026 00:00:00 +0000 https://nalar.dev/http-message-signatures-bind-selected-http-components/ Thu, 24 Sep 2026 00:00:00 +0000 https://nalar.dev/http-message-signatures-bind-selected-http-components/ <p>TLS protects an HTTP exchange while traffic moves across a TLS connection, but some application designs need a cryptographic assertion attached to the HTTP message itself. A gateway may terminate TLS before forwarding a request, a service may need to authenticate selected request metadata, or a message may cross several HTTP hops where transport protection and application trust are separate concerns.</p> <p>HTTP Message Signatures, specified in RFC 9421, address that boundary. A signer chooses HTTP message components, constructs a defined signature base, signs it, and sends metadata that tells a verifier which components and parameters were covered. The mechanism is selective by design: a signature does not automatically cover every field or every property of the message.</p>