#http #signatures #digest


An HTTP Signatures library that leaves the signing to you

15 releases

0.7.0 Dec 8, 2022
0.6.1 Nov 29, 2022
0.6.0 Jan 17, 2022
0.5.4 Sep 18, 2021
0.1.0 Sep 21, 2019

#2172 in Cryptography

Download history 449/week @ 2023-11-04 493/week @ 2023-11-11 542/week @ 2023-11-18 763/week @ 2023-11-25 540/week @ 2023-12-02 595/week @ 2023-12-09 569/week @ 2023-12-16 338/week @ 2023-12-23 387/week @ 2023-12-30 742/week @ 2024-01-06 547/week @ 2024-01-13 573/week @ 2024-01-20 656/week @ 2024-01-27 443/week @ 2024-02-03 516/week @ 2024-02-10 580/week @ 2024-02-17

2,337 downloads per month
Used in 23 crates (5 directly)


742 lines

HTTP Signature Normaliztion

An HTTP Signatures library that leaves the signing to you

Http Signature Normalization is a minimal-dependency crate for producing HTTP Signatures with user-provided signing and verification. The API is simple; there's a series of steps for creation and verification with types that ensure reasonable usage.

use chrono::Duration;
use http_signature_normalization::Config;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = Config {
        expires_after: Duation::secs(5),

    let headers = BTreeMap::new();

    let signature_header_value = config
        .begin_sign("GET", "/foo?bar=baz", headers)
        .sign("my-key-id".to_owned(), |signing_string| {
            // sign the string here
            Ok(signing_string.to_owned()) as Result<_, Box<dyn std::error::Error>>

    let mut headers = BTreeMap::new();
    headers.insert("Signature".to_owned(), signature_header_value);

    let verified = config
        .begin_verify("GET", "/foo?bar=baz", headers)?
        .verify(|sig, signing_string| {
            // Verify the signature here
            sig == signing_string



Feel free to open issues for anything you find an issue with. Please note that any contributed code will be licensed under the AGPLv3.


Copyright © 2022 Riley Trautman

HTTP Signature Normalization is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

HTTP Signature Normalization is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. This file is part of HTTP Signature Normalization.

You should have received a copy of the GNU General Public License along with HTTP Signature Normalization. If not, see http://www.gnu.org/licenses/.