Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say, so a server can verify certain HTTP headers and the HTTP body were constructed by a client).
Is there some way to use JWS to verify HTTP requests? I could come up with some definition of the JWS payload: some sort of "canonical" combination of HTTP headers and body, but I would have thought this would have already been designed...
Or perhaps, suggest an alternative mechanism.