4 hours ago
- RFC 9421 describes HTTP Message Signatures for creating, encoding, and verifying digital signatures over HTTP message components.
- Message Signatures ensure selected parts of HTTP requests arrive unmodified, even through proxies, load balancers, or CDNs.
- curl now experimentally supports HTTP Message Signatures with four new command-line options: --httpsig-algo, --httpsig-key, --httpsig-keyid, and --httpsig-headers.
- The default signing algorithm is ed25519, with hmac-sha256 also supported.
- Corresponding libcurl options (e.g., CURLOPT_HTTPSIG_ALGORITHM) are available for developers.
- This feature is marked experimental and requires explicit build enabling; backward compatibility is not guaranteed.
- The feature will ship in curl 8.22.0, contributed by Sameeh Jubran.