HTTP Signature library where you bring the crypto
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
asonix d3c715ecc5 Update to actix-web 4.0.0-beta.3 3 weeks ago
http-signature-normalization-actix Update to actix-web 4.0.0-beta.3 3 weeks ago
http-signature-normalization-http Add ability to require headers in signature 10 months ago
http-signature-normalization-reqwest Update reqwest client lib 1 month ago
http-signature-normalization-warp Remove unneeded clone 1 year ago
src Add methods for explicit mastodon compat, requiring digest 5 months ago
.gitignore Add support for actix-web and http 1 year ago
Cargo.toml Add methods for explicit mastodon compat, requiring digest 5 months ago
LICENSE Initial commit 1 year ago Add lemmy to toplevel readme 10 months ago

HTTP Signature Normaliztion

An HTTP Signatures library that leaves the signing to you

Http Signature Normalization is a minimal-dependency crate for producing HTTP Signatures with user-provided signing and verification. The API is simple; there's a series of steps for creation and verification with types that ensure reasonable usage.

use chrono::Duration;
use http_signature_normalization::Config;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = Config {
        expires_after: Duation::secs(5),

    let headers = BTreeMap::new();

    let signature_header_value = config
        .begin_sign("GET", "/foo?bar=baz", headers)
        .sign("my-key-id".to_owned(), |signing_string| {
            // sign the string here
            Ok(signing_string.to_owned()) as Result<_, Box<dyn std::error::Error>>

    let mut headers = BTreeMap::new();
    headers.insert("Signature".to_owned(), signature_header_value);

    let verified = config
        .begin_verify("GET", "/foo?bar=baz", headers)?
        .verify(|sig, signing_string| {
            // Verify the signature here
            sig == signing_string



Unless otherwise stated, all contributions to this project will be licensed under the CSL with the exceptions listed in the License section of this file.


This work is licensed under the Cooperative Software License. This is not a Free Software License, but may be considered a "source-available License." For most hobbyists, self-employed developers, worker-owned companies, and cooperatives, this software can be used in most projects so long as this software is distributed under the terms of the CSL. For more information, see the provided LICENSE file. If none exists, the license can be found online here. If you are a free software project and wish to use this software under the terms of the GNU Affero General Public License, please contact me at and we can sort that out. If you wish to use this project under any other license, especially in proprietary software, the answer is likely no.

Http Signature Normalization is currently licensed under the AGPL to the Lemmy project, found at