I am reading how different services are handling API signature and authentication.
Particularly I was looking at:

AWS Signing v4
WeChat Signature Algorithm
Alipay Digital Signature
Google Maps API

I see the algorithm Amazon is using for signing is quite complicated, while the ones used by Alipay, WeChat and Google are simpler (they basically just concatenate the request parameters): is there any open-standard to create request signature?
Is there any reason for making it the way Amazon does it?


Fully analyzing all four would make this answer too long, but let's compare the AWS and AliPay schemes.

Alipay HTTP signatures

Alipay JSON signatures

To me this looks very similar to the Signed JWT / JSON Web Signature (JWS) scheme (wikipedia, official spec in RFC 7515). So the entire contents of the JSON body will be protected by the signature. But that's not the entire message. The full HTTP message will include headers and be something like (I'm inventing this)

POST /api/v3/payment/paycancel HTTP/1.1
Host: alipay.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Authorization: f2a905cba5482c77c4468d5f62c3cafe35c8c76ff7effae2e15085bd1edb579af9729b487753cc2f95ae9099a005a4ef2c013c8531c0addb8771b527cf3508bb
Content-Type: application/json    
Referer: https://www.google.com/
Origin: https://www.google.com
DNT: 1
Connection: keep-alive
Content-Length: 787


Now, with Alipay's signature scheme, only the JSON body is protected, not the HTTP headers. Could an attacker do damage by intercepting your request and modifying the HTTP headers? Maybe.

AWS HTTP signatures

The AWS page you link to says:

To sign a request, you first calculate a hash (digest) of the request. Then you use the hash value, some other information from the request, and your secret access key to calculate another hash known as the signature. Then you add the signature to the request in one of the following ways:

  • Using the HTTP Authorization header.
  • Adding a query string value to the request. Because the signature is part of the URL in this case, this type of URL is called a presigned URL.

While that page doesn't give a whole lot of technical detail, it sounds like they are trying to sign over the entire HTTP request (including headers) and not just the JSON body.

Wouldn't it be great if HTTP signatures were standardized?

It's been tried. Many times.

In 1999 RFC2660 defined the Secure HyperText Transfer Protocol (S-HTTP), which carries HTTP messages inside Cryptographic Message Syntax (CMS) containers -- the same trick that S/MIME uses to encrypt and sign email. For whatever reason, this never caught on.

More recently, I've seen a couple of attempts at the IETF to sign HTTP requests and responses using headers, similar to what AWS does above:

TL;DR: signing HTTP messages sounds obvious, and it is if you only care about signing the payload of responses and POST requests -- do what Alipay has done and use JWS. Signing the entire HTTP message, including the requested URL and other headers is a lot tricker and standards bodies have been trying for over 20 years to come up with an HTTP signing mechanism that is both secure and flexible.

| improve this answer | |
  • Thanks for your answer. Looking at the four methods, I guess Alipay looks a good compromise in securing the entire content keeping a simpler method. I don't really like the idea of injecting content from the header into the request body, but I guess there is not much choice. – pasine Apr 13 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.