Repository navigation
fix(web-bot-auth): require https for directory Signature-Agent members - #163
Open
KonstantinMirin wants to merge 3 commits into
Open
KonstantinMirin wants to merge 3 commits into
KonstantinMirin wants to merge 3 commits into
Conversation
draft-ietf-webbotauth-httpsig-protocol-00 Section 5.2.1 requires each Signature-Agent member value to be a URI "whose scheme MUST be https", and Section 5.5.1 says "The directory MUST be served over HTTPS". The TypeScript and Rust parsers required https for jwks_uri and cimd but accepted http for directory, so verify() handed an http origin to the resolver. Apply the https check to every discovery type in both parsers.
…ent tests The https check is one branch for every discovery type, but the tests exercised only directory members. Add jwks_uri and cimd members with http URIs to the TypeScript and Rust tests, and assert the type-specific error message for each.
parse_signature_agent_header rejects every member that does not use https, so parse_link never receives an http URI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
draft-ietf-webbotauth-httpsig-protocol-00Section 5.2.1 requires eachSignature-Agentmember value to be a URI "whose scheme MUST be https", and Section 5.5.1 says "The directory MUST be served over HTTPS". The TypeScript and Rust parsers requiredhttpsforjwks_uriandcimd, but acceptedhttpfordirectory, soverify()handed anhttporigin to the resolver.This change applies the
httpscheck to every discovery type in both parsers. Thedirectoryerror message changes from "directory Signature-Agent must use http or https" to "directory Signature-Agent must use https", the same form as thejwks_uriandcimdmessages.In the Rust crate,
parse_linkinWebBotAuthVerifier::parseno longer checks for anhttp://prefix. The parser rejects those members first, so that branch was unreachable.Fixes #162.
Tests
packages/web-bot-auth: 53 passed on Node 24 and Node 26. The parser tests cover anhttpmember in the dictionary form, thetype=directoryform, the legacy String form, and thejwks_uriandcimdtypes. Averify()test checks that the resolver is not called for anhttpdirectorymember.crates/web-bot-auth: 42 passed, with Rust 1.95 becausesfv0.16 requires it. Everytest-ruststep inpullrequest.ymlpasses, including thewasm32-unknown-unknownbuild,clippy -D warnings,rustfmt, andcargo doc.npm run lint(prettier --checkandoxlint) is clean, and the other workspaces' tests pass:http-message-sig35,jsonwebkey-thumbprint2, andverification-workers22.Without the source change, the four
directorytests in TypeScript and the Rust test fail. Thejwks_uriandcimdcases pass either way: they check that the shared branch still rejects those types.Compatibility
sign()andverify()throw for anhttpdirectorymember, including a legacy StringSignature-Agent. Nothing in the repository's examples, bench fixtures, or test vectors uses one.