Where is (key-id) defined

[OR13]

https://tools.ietf.org/html/draft-cavage-http-signatures-12

What is the significance of the parenthesis.

[OR13]

https://github.com/digitalbazaar/http-signature-header/blob/master/lib/index.js#L138

:(

[dlongley]

See also: https://tools.ietf.org/html/draft-ietf-httpbis-message-signatures-00#section-2.4

There are a number of things that aren't strictly "headers" in HTTP (and even more in HTTP/2+, IIRC) such as the path and request target. This and the need to include meta data attributes of the signature itself (created/expires) informed the need for "pseudo-headers" so that this data could be signature-covered content.

[dlongley]

Hmm, it doesn't look like ensuring that the "key-id" is covered by the signature has made it into the latest draft, but it is mentioned as a discussion point: "B.1.11. Verification key identifier is not signed". Anyway, implementations such as the one in this repo are including it.

[aljones15]

Version 12 is not the latest version actually: https://tools.ietf.org/html/draft-ietf-httpbis-message-signatures-00

covered content that is in parenthesis are pseudo-headers which are values that are specified inside of the Signature Header like this:

Authorization: Signature keyId="did:key:foo" header="(key-id)"

Sorry about the wait on this, I'm going to make a list of all the normative statements from 12 vs the latest spec 00 and see what we are missing.

EDIT: Orie my apologies about this. I can't seem to find where (key-id) came from either. It's not in version 12 or the latest. For my benefit the spec might have changed.

it looks like I might have been following the naming convention as (request-target) is also a pseudo-header and kebab case.

[OR13]

I did this over the weekend https://github.com/transmute-industries/axios-http-signatures

pulling from your code / attempting to be compatible.... but found myself really wanting to be able to point to some version of the spec, and have "conformance".... which I expect is not possible...

There are a number of breaking changes in the works (structure headers), and it would be nice to publish something stable before attempting them.

[aljones15]

@OR13 there is this: https://github.com/w3c-ccg/http-signatures-test-suite

however those tests are based around an older draft at this point, but some of the suites should still be compatible.

[OR13]

Its based on Spec v11.... which says:

  WARNING: DO NOT IMPLEMENT THIS SPECIFICATION AND PUSH THE CODE INTO
   PRODUCTION.  THIS VERSION OF THE SPECIFICATION IS ONLY FOR
   EXPERIMENTAL IMPLEMENTATIONS.

I suppose its still good to point to spec v11 for the various working draft.