Identify Bots with HTTP Message Signatures

HTTP Message Signatures are a mechanism to create, encode, and verify signatures over components of an HTTP message. They are standardised by the IETF in RFC 9421. This website validates the presence of such signature as defined in draft-meunier-web-bot-auth-architecture.

This website checks for an Ed25519 signature on incoming request. They should be signed by a test public key defined in Appendix B.1.4 of RFC 9421.

Why do platforms and websites need this?

As a platform provider, I would like to ensure websites are able to identify requests originating from my service. At the moment, I share IP ranges, but this is long to deploy, cumbersome to maintain, and costly, especially with the multiplication of services, and the need to localise outgoing traffic with a forward proxy. It's even more pressing as I onboard multiple companies on my platform that need to have their own identity. And user agent headers do not have any integrity protection.

It's time for websites to know who's calling, and for platforms to prove it.

How to retrieve the public key used by this website

We define a key directory accessible under /.well-known/http-message-signatures-directory The directory looks as follow

{
  "keys": [
    {
      "kid":"poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U",
      "kty":"OKP",
      "crv":"Ed25519",
      "x":"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs",
      "nbf": 1743465600000
    }
  ],
  "purpose": "rag"
}
      

Parameters are defined as follow:

• keys: an array of serialised JSON Web Key defined by RFC 7517
  • kid: JWK Thumbprint as defined in RFC 7638
  • nbf: start of the validity of the public key as a unix timestamp in milliseconds defined by RFC 7519
  • exp: end of the validity of the public key as a unix timestamp in milliseconds defined by RFC 7519
  • ...jwk: JWK public cryptographic material
• purpose: represents what a signature means. Examples could be the draft for Short usage preference proposed.

It's hard to debug. How can this website help?

This website expose an endpoint dropping incoming request headers on /debug

I have comments and want to contribute. Where do I go?

First off, this is fantastic news!

To contribute to this website, you can go to cloudflareresearch/web-bot-auth.

To contribute to the standard discussion, the current draft is hosted on thibmeu/http-message-signatures-directory, and is being discussed on web-bot-auth IETF mailing list.