[Security] HTTP Signature Verification: Missing Body Digest Validation #18
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The Verifier.VerifyRequest function in internal/httpsig/verifier.go lacks explicit validation of the request body's digest. While it creates an httpsig.NewVerifier(r), it does not verify that the body content actually matches the Digest header if one is provided in the signature headers. This could lead to a scenario where the request headers (including the signature) are valid, but the body has been tampered with. Proposed Fix: If maxBodyBytes is provided and the request has a body, calculate the digest of the body and ensure it matches the Digest header provided in the request before calling verifier.Verify.