Subject: Signature [protocol element] identifiers

From: Justin Richer <[email-masked]>
Date: Tue, 29 Jun 2021 15:41:22 -0400

I just pushed a strawman proposal for new identifiers for elements covered by the signature, and the editors would like feedback on this. I tried to base the language on the draft semantics and messaging drafts, but I’m sure I mixed a few things up — please help us make sure these things are right!

https://github.com/httpwg/http-extensions/pull/1565 <https://github.com/httpwg/http-extensions/pull/1565>

This also removes the “@request-target” identifier, which was problematic for a number of reasons. In its stead you can now use “@method” and “@request-origin” (or some combination of “@path” and “@query”) to cover the same elements of a request.

As a side note, we know that terms like “covered content” are problematic and will be fixing that language in a different PR in the future. So that wires don’t get crossed with that related conversation, please limit feedback to the definitions of these items, both in terms of the identifier used and the value generation and canonicalization method.

Thank you!
 — Justin