Package: httpie-http-message-signatures
httpie-http-message-signaturesAn authentication plugin forHTTPie, implementing theIETF HTTP Message Signaturesdraft specification.This is an incompatible replacement for and not to be confused with the"Cavage" HTTP Signaturesdraft.InstallationThe preferred installation method is via thehttpie cli pluginsutility:$ httpie cli plugins install httpie-http-message-signaturesYou may also download this repository and install from a local source:$ cd httpie-http-message-signatures
$ httpie cli plugins install .Last but not least, you can install viapipas well:$ pip install --upgrade httpie-http-message-signaturesUsageUsemessage-signatureas the auth-type:http -A message-signature ...The HTTP Message Signature draft allows for a whole bunch of parameters to influence the signature. Because this can
get somewhat overwhelming quickly, this plugin allows the parameters to be passed in two different ways:-a/--authcommand line parameterThis allows passing arguments inline, in the following format:key_id ":" key [":" covered_component_ids]In other words, the key id, followed by a:, followed by the private key as base 64 encoded string,optionallyfollowed by another:and a list of comma-separated covered component ids. For example:$ http -A message-signature -a foobar:cDf/J30Q7EtXmZZ91j4OLg== example.com
$ http -A message-signature -a foobar:cDf/J30Q7EtXmZZ91j4OLg==:@authority,@method example.com~/.httpmessagesignaturesrcfileIf no parameters are passed via-a/--auth, the plugin will look for a file called.httpmessagesignaturesrcin the home directory. This file is a simpleINI-like file format, which contains sections for different hosts,
each with their own settings. A[DEFAULT]section can be used to set defaults for all hosts. For example:[DEFAULT]
covered_component_ids = @method,@authority,@target-uri,content-digest

[example.com]
key_id = foobar
key = cDf/J30Q7EtXmZZ91j4OLg==

[*.example.com]
key_id = uydnfpw0xnegmpx2op3rhw2qm
key = nkAFfoSEN/rXWu6PrqsmntUeeSZ+aEoGD9YmxIxwjNxdlHPO4QYcSS+4aRroRHl92vEEipRCsr+j2tFVlPimfA==
covered_component_ids = @method,@authority,@path,@query-params,content-digestHost names allow for wildcard patterns.Covered component idsDifferent parts of the HTTP request can be included in the signature. By default, these components are included:@method@authority@target-uriYou can override this default list via the optional third command line argument or thecovered_component_idsvalue
in the~/.httpmessagesignaturesrcfile. The plugin recognizes two special component ids:content-digestWhen specifyingcontent-digestas a covered component, and the request has a request body, the plugin will add aContent-Digestheader to the request and include it in the signature. This allows easy signing of request bodies.@query-paramsThe default@target-uricomponent signs the entire URI, including query parameters. Depending on your use case,
you may need to sign the request path and query parameters separately. For this case the specification requires
for every signed query parameter to be listed separately as its own component. E.g. a request tohttp://example.com/foo/?bar=baz&quux=42would have to look like this:$ http -A message-signature \
       -a 'foobar:cDf/J30Q7EtXmZZ91j4OLg==:"@query-params";name="bar","@query-params";name="quux"' \
       example.com bar==baz quux==42Since this is of course highly inconvenient, the special component id@query-paramswill automatically be expanded
to include all passed query parameters. So the above request can be shortened to:$ http -A message-signature -a foobar:cDf/J30Q7EtXmZZ91j4OLg==:@query-params example.com bar==baz quux==42See the specification for acomplete list of derived component names, but an incomplete list is presented here:@method@target-uri@authority@scheme@request-target@path@query@query-paramImplementationThis plugin is a wrapper aroundhttp-message-signatures.