Request Signature

Overview

Meaning in plain language

Request Signature is a cryptographic signature that covers selected components of an HTTP or API request so the receiver can verify integrity, signer identity, and sometimes freshness. It can protect the method, target, headers, and body context, whereas a payload signature may cover only the message body.

How it works

The principal risks include signature wrapping, omitted security-critical headers, canonicalization disagreement, replay, key confusion, clock skew, proxy rewriting, and signing one target while sending another. It can protect the method, target, headers, and body context, whereas a payload signature may cover only the message body.

A production implementation should define covered components, canonicalization, algorithm, key lookup, timestamps, nonces, replay window, proxy behavior, and error handling; protect signing keys and rotate them safely. For Request Signature, secrets and tokens should remain outside browser bundles, URLs, ordinary logs, and unprotected configuration.

Useful measures include verification failures by reason, replay rejections, clock-skew errors, unknown key IDs, signing latency, and requests rejected after intermediary modification. Request Signature is closely connected to Payload Signature , Authorization Header , and Mutual TLS Client Authentication (mTLS) . The Request Signature recovery process should restore access without bypassing the original identity and authorization controls.

Changes to Request Signature should preserve overlap or recovery where required while preventing old credentials from remaining active indefinitely. Evidence for Request Signature should record the credential or certificate identifier and decision result without retaining the secret itself.

Monitoring for Request Signature should track failed use, unusual scope or audience, expiry, rotation status, and attempts involving revoked credentials. Least-privilege configuration for Request Signature should be verified against the operations used by each environment and consuming service.

Where people get it wrong

Both sides must agree on byte-level canonicalization. A valid signature does not by itself prevent replay unless a timestamp or nonce is checked.

Related concepts

Signing Key, Webhook Authentication, Webhook Verification.

Reference

OWASP API Security Top 10 (2023).