geomind_research/herolib_rust
18
0
Fork 1
Code Issues 15 Pull requests Projects 1 Releases Packages 1 Wiki Activity Actions

develop herolib httpsig #32

Closed
sameh-farouk wants to merge 30 commits from develop-herolib-httpsig into develop
pull from: develop-herolib-httpsig
merge into: geomind_research:develop
Conversation 0 Commits 30 Files changed 87 +5368 -1
sameh-farouk commented 2025-12-31 15:59:57 +00:00
Member
Copy link

PR Description: Add herolib-httpsig Module

Summary

Implements RFC 9421 (HTTP Message Signatures) and RFC 9530 (Content-Digest) with Ed25519 cryptography for secure HTTP request/response authentication.

Features

  • ✅ RFC Compliant: Full RFC 9421 & RFC 9530 implementation
  • ✅ Universal HTTP Support: Works with any library using http crate (reqwest, hyper, axum, etc.)
  • ✅ Ed25519 Signatures: Fast, secure cryptography via herolib-keys
  • ✅ Replay Protection: Configurable timestamp tolerance (default: 60s)
  • ✅ Mandatory Security: Always signs @method, @path, @authority, content-digest
  • ✅ Rhai Integration: Optional scripting support with 7 tests + 2 examples

API

// Sign requests
let signer = HttpSigner::new(keypair, "key-id");
signer.sign_request(&mut request, body)?;

// Verify requests
let verifier = HttpVerifier::new().with_key(public_key);
verifier.verify_request(&request, body)?;

Testing

  • 31 unit tests + 11 doc tests (Rust)
  • 7 integration tests + 2 examples (Rhai)
  • Zero warnings, no unsafe code

Security

  • Tight 60s default tolerance (balances security & clock skew)
  • Mandatory body digest (prevents tampering)
  • Canonical component normalization (prevents manipulation)
  • Comprehensive input validation
# PR Description: Add `herolib-httpsig` Module ## Summary Implements RFC 9421 (HTTP Message Signatures) and RFC 9530 (Content-Digest) with Ed25519 cryptography for secure HTTP request/response authentication. ## Features - ✅ **RFC Compliant**: Full RFC 9421 & RFC 9530 implementation - ✅ **Universal HTTP Support**: Works with any library using `http` crate (reqwest, hyper, axum, etc.) - ✅ **Ed25519 Signatures**: Fast, secure cryptography via `herolib-keys` - ✅ **Replay Protection**: Configurable timestamp tolerance (default: 60s) - ✅ **Mandatory Security**: Always signs `@method`, `@path`, `@authority`, `content-digest` - ✅ **Rhai Integration**: Optional scripting support with 7 tests + 2 examples ## API ```rust // Sign requests let signer = HttpSigner::new(keypair, "key-id"); signer.sign_request(&mut request, body)?; // Verify requests let verifier = HttpVerifier::new().with_key(public_key); verifier.verify_request(&request, body)?; ``` ## Testing - 31 unit tests + 11 doc tests (Rust) - 7 integration tests + 2 examples (Rhai) - Zero warnings, no unsafe code ## Security - Tight 60s default tolerance (balances security & clock skew) - Mandatory body digest (prevents tampering) - Canonical component normalization (prevents manipulation) - Comprehensive input validation
# Conflicts:
#	packages/herodo/src/main.rs
sameh-farouk closed this pull request 2025-12-31 17:21:21 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
geomind_research/herolib_rust!32
No description provided.