Signing HTTP requests with JWS

Question

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say, so a server can verify certain HTTP headers and the HTTP body were constructed by a client).

Is there some way to use JWS to verify HTTP requests? I could come up with some definition of the JWS payload: some sort of "canonical" combination of HTTP headers and body, but I would have thought this would have already been designed...

Or perhaps, suggest an alternative mechanism.

Answer 1

There is "Signing HTTP Requests via JSON Web Signatures" https://datatracker.ietf.org/doc/html/draft-richanna-http-jwt-signature-00 that specifies a method [although it has expired].

It seems to require that the JWS payload is JSON [which is not true in general for JWS, I believe]. It adds sha256 hashes to the JSON object. For example, for HTTP headers in a canonicalised string of:

content-type: application/json
etag: 742-3u8f34-3r2nvv3

that has sha256 bZA981YJBrPlIzOvplbu3e7ueREXXr38vSkxIBYOaxI, then it adds to the JSON payload:

"h": [["content-type", "etag"], "bZA981YJBrPlIzOvplbu3e7ueREXXr38vSkxIBYOaxI"]

I'm not such a crazy fan of this for the facts that it requires certain top-level keys in the JSON payload, and that it requires a JSON payload at all. For example, seems tricky to use this for a large binary payload.