Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say, so a server can verify certain HTTP headers and the HTTP body were constructed by a client).

Is there some way to use JWS to verify HTTP requests? I could come up with some definition of the JWS payload: some sort of "canonical" combination of HTTP headers and body, but I would have thought this would have already been designed...

Or perhaps, suggest an alternative mechanism.


1 Answer 1


There is "Signing HTTP Requests via JSON Web Signatures" https://datatracker.ietf.org/doc/html/draft-richanna-http-jwt-signature-00 that specifies a method [although it has expired].

It seems to require that the JWS payload is JSON [which is not true in general for JWS, I believe]. It adds sha256 hashes to the JSON object. For example, for HTTP headers in a canonicalised string of:

content-type: application/json
etag: 742-3u8f34-3r2nvv3

that has sha256 bZA981YJBrPlIzOvplbu3e7ueREXXr38vSkxIBYOaxI, then it adds to the JSON payload:

"h": [["content-type", "etag"], "bZA981YJBrPlIzOvplbu3e7ueREXXr38vSkxIBYOaxI"]

I'm not such a crazy fan of this for the facts that it requires certain top-level keys in the JSON payload, and that it requires a JSON payload at all. For example, seems tricky to use this for a large binary payload.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.