httpsig

README

httpsig

httpsig is a Go library allowing everyone to easily add Mastodon/ActivityPub-compatible HTTP signature to any HTTP request as well as verify the validity of a request's signature originating from an ActivityPub server.

Usage

Signing requests

package main

import (
	//...
	
	"github.com/MatejLach/httpsig"
)

func main() {
	// ...
	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("%s/user/me", server.URL), nil)
	if err != nil {
		// error handling
	}

	reqActorPubKeyId, err := url.Parse(fmt.Sprintf("%s/user/me", server.URL))
	if err != nil {
		// error handling
	}

	err = httpsig.SignRequest(context.Background(), req, reqActorPubKeyId, privateKeyPem.String())
	if err != nil {
		// error handling
	}
}

Verifying requests

package main

import (
	//...
	
	"github.com/MatejLach/httpsig"
)

func main() {
	// ...
	validSignature, err := httpsig.ReqHasValidSignature(context.Background(), req, "", true)
	if err != nil { 
		// error handling
	}
}

See the test suite for a more complete example.

Contributing

Pull requests and bug reports are welcome.

Documentation

Index

• func ReqHasValidSignature(ctx context.Context, req *http.Request, reqAuthorPubKeyPem string, ...) (bool, error)
• func SignRequest(ctx context.Context, req *http.Request, keyId *url.URL, privateKeyPem string) error

Functions

func ReqHasValidSignature

func ReqHasValidSignature(ctx context.Context, req *http.Request, reqAuthorPubKeyPem string, strictMode bool) (bool, error)

ReqHasValidSignature validates the signature of POST requests by default reqAuthorPubKeyPem can optionally be specified to be the public key (RSA-SHA256 PEM format) of the actor sending the request, if it is empty, the key is fetched using http.Get strictMode=true additionally validates GET request signature as well as that the request Date is within the last 12 hours

func SignRequest

func SignRequest(ctx context.Context, req *http.Request, keyId *url.URL, privateKeyPem string) error