Implementing RFC 8941 Structured Field Values for HTTP - 10/1/2025, 11:00:13 PM

https://video.asonix.dog/w/gjYp9iFhX4eCV5wGuggHzT

Implementing RFC 8941 Structured Field Values for HTTP - 9/30/2025, 11:00:15 PM

https://video.asonix.dog/w/ng6rNqDEUQyuXgzxg7R7UL

Implementing RFC 9421 HTTP Message Signatures - 9/29/2025, 11:00:41 PM

https://video.asonix.dog/w/pQ3dhA6yUxS2rLhzUVCnCd

Implementing RFC 9421 HTTP Message Signatures - 9/26/2025, 10:55:34 PM

https://video.asonix.dog/w/tf8aBZ2bh4BeoeJSzUfqc9

For some reason I was sending an invalid value with the alg property, and, uhhh, Matthew, you really should have paid attention to Section 3.3 under each algorithm where it states the possible acceptable values:

• rsa-pss-sha512
• rsa-v1_5-sha256
• hmac-sha256
• ecdsa-p256-sha256
• ecdsa-p384-sha384
• ed25519

I only have support for rsa-v1_5-sha256 (incoming or outgoing) at the moment (as does Mastodon), but finally I have my first successful signed RFC 9421 POST requests to both a Mastodon instance and Wordpress ActivityPub Plugin instance. Those plugins are handling the covered components that I chose to use fine.

Rereading RFC 9421 HTTP Message Signatures again I noticed that I had missed some specifics to case-sensitivity with regard to covered component values.

• @method value is case-sensitive so the value should be as-is.
• @authority value is normalized to lowercase and the default port is omitted.
• @scheme value MUST be normalized to lowercase.
• Other values are not mentioned specifically so should be as-is based on the HTTP specification including @request-target, @target-uri, @path, and @query. And anything with query parameters could have percent-octet encoded values.

I have been wrongly transforming most values because of muscle memory of cavage-12 draft signature.

שאלה לגבי RFC 9421: מישהי יודעת על ספציפיקציה להעברת מפתחות ציבוריים לשרת? יש דרך לזהות איזה מפתח משומש בבקשה מסוימת?

Question about RFC 9421: how is one supposed to transfer a public key to the server to verify signatures, or to infer what key a request uses? Is this a me problem, or is there a spec?

#meta #rfc9421 #activitypub

When double-knocking for RFC 9421, Lemmy will respond with a 400 Bad Request, so I need to check that as well as a 401 in order to figure out if I should send a follow-up cavage-12 request.

In other news, I still have not debugged why only POST requests are not valid on Mastodon for RFC 9421. There is something unique about comparing the signatures when only content-digest is included, but it is not the digest itself because otherwise Mastodon would raise a validation error earlier. At the moment, only one Mastodon instance I federate with is accepting those requests anyway. Hopefully the error messages aren't too bad.