"signature";req and "signature-input";req are not recommended
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Quiet
- Domain
- documentation, security
Research direction
Review FAPI 2.0 Message Signing §5.6.2.1 alongside RFC 9421 §2.4 and the linked security discussion. Determine whether the third clause requires "signature";req and "signature-input";req, then update the specification wording if that interpretation is confirmed and verify it addresses the cited RFC warning.
Written by the indexing model from the issue text.
Description
Originally submitted by Takahiko Kawasaki (Takahiko Kawasaki) on 2024-09-20
FAPI 2.0 Message Signing, Section 5.6.2.1. Resource servers, the third clause says as follows:
if the request was signed, shall include the request signature and request signature input in the response signature input by means of the
reqboolean flag defined in Section 2.4 of [RFC9421];
If this clause means that "signature";req and "signature-input";req must be included in the signature base (and there seems to be no other way to interpret it), then this clause should be removed.
The third-to-last paragraph of Section 2.4. Signing Request Components in a Response Message in RFC 9421 HTTP Message Signatures states the following and explicitly says it is “NOT RECOMMENDED” to do so for security reasons.
While it is syntactically possible to include the Signature and Signature-Input fields of the request message in the signature components of a response to a message using this mechanism, this practice is NOT RECOMMENDED. This is because signatures of signatures do not provide transitive coverage of covered components as one might expect, and the practice is susceptible to several attacks as discussed in Section 7.3.7. An application that needs to signal successful processing or receipt of a signature would need to carefully specify alternative mechanisms for sending such a signal securely.
Bitbucket status: open
Bitbucket origin: issue 718
- Dominant language
- HTML
- Stars
- 4
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Getting set up
We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openid/fapi
-
component: FAPI 1: Advanced migrated-from-bitbucket priority: major type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
migrated-from-bitbucket priority: trivial type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
detecting inconsistent .well-known/openid-configuration vs .well-known/oauth-authorization-server on conformance testsPossibly taken @jogu claimed this 2 days ago. Opencomponent: Certification component: FAPI2: Advanced Authorization
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
component: Certification component: FAPI2: Security Profile
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
Docs: "Work with Codex from anywhere" page still claims Windows mobile support is "coming soon"Openapp documentation remote windows-os
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
librepods-org/librepods#802 ·
Maintainers usually reply within 1 day
-
area:lint-tooling found-by:critic kind:docs-drift
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
InauguralSystems/EigenScript#1335 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
Maintainers usually reply within 1 day
-
technical-improvement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 4 days