absolut-ticket/http-signatures-php

Sign and verify PSR-7 HTTP messages with HMAC and RSA keys

11.0.1 2020-04-30 09:10 UTC

Requires

• php: >=7.1
• ext-openssl: >=1.1.0
• psr/http-message: ^1.0

Requires (Dev)

• friendsofphp/php-cs-fixer: ^2
• guzzlehttp/psr7: ^1.2
• kriswallsmith/buzz: ^1.0
• nyholm/psr7: ^1.1
• nyholm/psr7-server: ^0.3.0
• phpunit/phpunit: ^5.7
• symfony/http-foundation: ~2.8|~3.0
• symfony/psr-http-message-bridge: ^1.0.2
• zendframework/zend-diactoros: ^1.1
• zendframework/zend-httphandlerrunner: ^1.1

MIT

• Benedikt Klocker
• Liam Dennehy
• Paul Annesley

• http
• https
• signature
• signing
• rsa
• hmac
• signed
• digital signature
• electronic signature

README

PHP implementation of Singing HTTP Messages draft specification; allowing cryptographic signing and verifying of PSR-7 messages.

Features

• Sign HTTP Messages according to Signing HTTP Message draft IETF RFC version 10
• Sign & verify messages using HMACs
• Sign & verify messages with RSA private/public keys
• Add a Digest header, or automatically add the header while signing in a single operation
• Verify a Digest header while verifying the signature

Complete documentation for this library can be found at Read The Docs

Simple Usage

Add liamdennehy/http-signatures-php to your composer.json.

• A message is assumed to be a PSR-7 compatible Request or Response.
• A Context object is used to configure the signature parameters, and prepare the verifier functionality.
• The signWithDigest function witll add a Digest header and digitally sign the message in a new Signature header.

Using an PSR-7 request $message ready to send:

  use HttpSignatures\Context;

  $context = new HttpSignatures\Context([
    'keys' => ['mykey' => file_get_contents('/path/to/privatekeyfile')],
    'algorithm' => 'rsa-sha256',
    'headers' => ['(request-target)', 'Date'],
  ]);

  $context->signer()->signWithDigest($message);

Contributing

Pull Requests are welcome, as are issue reports if you encounter any problems.

Note: Due to composer dependencies for the reference implementation composer install prior to local development is only posible on PHP 7.1, or by manually removing the incompatible dependencies using the command (wrapped for readability):

  composer remove --dev \
  nyholm/psr7 nyholm/psr7-server riswallsmith/buzz \
  endframework/zend-httphandlerrunner

License

HTTP Signatures PHP library is licensed under The MIT License (MIT).

Documentation of the library is licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)

Details are in the LICENSE file