"signature";req and "signature-input";req are not recommended
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 38/100
- Issue 类型
- 文档
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
调研方向
结合 RFC 9421 §2.4 和链接的安全讨论，审查 FAPI 2.0 Message Signing §5.6.2.1。确定第三条是否要求 "signature";req 和 "signature-input";req，然后在确认该解释后更新规范措辞，并验证其是否解决了所引用的 RFC 警告。
由索引模型根据 Issue 内容生成。
描述
Originally submitted by Takahiko Kawasaki (Takahiko Kawasaki) on 2024-09-20
FAPI 2.0 Message Signing, Section 5.6.2.1. Resource servers, the third clause says as follows:
if the request was signed, shall include the request signature and request signature input in the response signature input by means of the
reqboolean flag defined in Section 2.4 of [RFC9421];
If this clause means that "signature";req and "signature-input";req must be included in the signature base (and there seems to be no other way to interpret it), then this clause should be removed.
The third-to-last paragraph of Section 2.4. Signing Request Components in a Response Message in RFC 9421 HTTP Message Signatures states the following and explicitly says it is “NOT RECOMMENDED” to do so for security reasons.
While it is syntactically possible to include the Signature and Signature-Input fields of the request message in the signature components of a response to a message using this mechanism, this practice is NOT RECOMMENDED. This is because signatures of signatures do not provide transitive coverage of covered components as one might expect, and the practice is susceptible to several attacks as discussed in Section 7.3.7. An application that needs to signal successful processing or receipt of a signature would need to carefully specify alternative mechanisms for sending such a signal securely.
Bitbucket status: open
Bitbucket origin: issue 718
- 主要语言
- HTML
- 星标
- 4
- 派生
- 3
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
我们还没有检查这个项目的环境配置文件。先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
openid/fapi 的其他 Issue
-
component: FAPI 1: Advanced migrated-from-bitbucket priority: major type: bug
难度 2/5 1-3 小时 新手友好度 62/100
-
migrated-from-bitbucket priority: trivial type: bug
难度 2/5 1-3 小时 新手友好度 78/100
-
难度 5/5 一周以上 新手友好度 35/100
-
detecting inconsistent .well-known/openid-configuration vs .well-known/oauth-authorization-server on conformance tests可能已有人在做 @jogu 于 5 天前认领。 未关闭component: Certification component: FAPI2: Advanced Authorization
难度 5/5 一周以上 新手友好度 35/100
-
component: Certification component: FAPI2: Security Profile
难度 4/5 3-5 天 新手友好度 35/100
相似的 Issue
-
sync-en
难度 1/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
ACK_WAITING HELP_WANTED UPDATE_CS
难度 2/5 1-3 小时 新手友好度 78/100
OWASP/CheatSheetSeries#2458 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
l3montree-dev/devguard#3101 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 90/100
维护者通常 1 天内回复
-
area/documentation status/need-triage
难度 1/5 1 小时以内 新手友好度 95/100
google-gemini/gemini-cli#29548 ·
维护者通常 1 天内回复