{"id":51908790,"url":"https://github.com/panva/fetch-message-signatures","last_synced_at":"2026-07-27T02:00:54.762Z","repository":{"id":372914672,"uuid":"1310349000","full_name":"panva/fetch-message-signatures","owner":"panva","description":"HTTP Message Signatures (RFC 9421) for the Fetch API","archived":false,"fork":false,"pushed_at":"2026-07-24T08:55:09.000Z","size":121,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-07-24T10:10:03.526Z","etag":null,"topics":["rfc9421"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/panva.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"panva"}},"created_at":"2026-07-23T20:39:37.000Z","updated_at":"2026-07-24T08:56:21.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/panva/fetch-message-signatures","commit_stats":null,"previous_names":["panva/httpsig","panva/fetch-message-signatures"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/panva/fetch-message-signatures","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panva%2Ffetch-message-signatures","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panva%2Ffetch-message-signatures/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panva%2Ffetch-message-signatures/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panva%2Ffetch-message-signatures/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/panva","download_url":"https://codeload.github.com/panva/fetch-message-signatures/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panva%2Ffetch-message-signatures/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35933751,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-27T02:00:06.776Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["rfc9421"],"created_at":"2026-07-27T02:00:54.055Z","updated_at":"2026-07-27T02:00:54.751Z","avatar_url":"https://github.com/panva.png","language":"TypeScript","funding_links":["https://github.com/sponsors/panva"],"categories":[],"sub_categories":[],"readme":"# fetch-message-signatures\n\n`fetch-message-signatures` is a JavaScript module for HTTP Message Signatures ([RFC 9421][]) built\non the Fetch API.\n\nThe module provides sender, recipient, and `Accept-Signature` operations on top of `Request`,\n`Response`, `Headers`, and `fetch`, together with Web Cryptography implementations for ECDSA P-256,\nECDSA P-384, and Ed25519. RSA, HMAC, and other cryptography can be supplied through custom\nproviders. Trusted-key selection and authorization remain application responsibilities.\n\n## [💗 Help the project](https://github.com/sponsors/panva)\n\nSupport from the community to continue maintaining and improving this module is welcome. If you find\nthis module useful, please consider supporting this project by\n[becoming a sponsor](https://github.com/sponsors/panva).\n\n## Dependencies: 0\n\n`fetch-message-signatures` has no dependencies and it exports tree-shakeable ESM from a single\nmodule.\n\n## [API Reference](docs/README.md)\n\n`fetch-message-signatures` is distributed via\n[npmjs.com](https://www.npmjs.com/package/fetch-message-signatures),\n[jsdelivr.com](https://www.jsdelivr.com/package/npm/fetch-message-signatures), and\n[github.com](https://github.com/panva/fetch-message-signatures).\n\n## Quick Start\n\n```ts\nimport * as FetchSig from 'fetch-message-signatures'\n\n// 1. Generate a non-extractable private key and create its providers\nconst { privateKey, publicKey } = await FetchSig.generateEd25519KeyPair()\nconst signer = FetchSig.ed25519Signer(privateKey)\nconst verifyWithKey = FetchSig.ed25519Verifier(publicKey)\n\n// 2. Resolve trusted key material from authenticated application configuration\nconst verifier: FetchSig.VerifierFactory = (signature, context) =\u003e {\n  const keyid = signature.parameters.find(([name]) =\u003e name === 'keyid')?.[1]\n  if (keyid !== 'example-key') {\n    throw new Error('Untrusted signing key')\n  }\n  return verifyWithKey(signature, context)\n}\n\n// 3. Sign a Fetch request. A `created` timestamp is added automatically\nconst request = await FetchSig.sign(new Request('https://api.example/orders/123'), {\n  signer,\n  components: ['@method', '@authority', '@path'],\n  parameters: { alg: 'ed25519', keyid: 'example-key' },\n})\n\n// sig1=(\"@method\" \"@authority\" \"@path\");created=1735689600;alg=\"ed25519\";keyid=\"example-key\"\nconsole.log(request.headers.get('signature-input'))\n// sig1=:\u003cbase64 of the 64 Ed25519 signature bytes\u003e:\nconsole.log(request.headers.get('signature'))\n\n// 4. Verify it against explicit recipient policy\nconst verified = await FetchSig.verify(request, {\n  verifier,\n  policy: {\n    requiredComponents: ['@method', '@authority', '@path'],\n    requiredParameters: ['created', 'alg', 'keyid'],\n    algorithms: ['ed25519'],\n    maxAge: 60,\n  },\n})\n\n// sig1 ed25519\nconsole.log(verified.label, verified.algorithm)\n```\n\nThe bytes that were signed are one canonicalized line per covered component plus the\n`@signature-params` line, which repeats the `Signature-Input` member value. `createSignatureBase()`\nreturns exactly that string, which is the first thing to compare when two implementations disagree:\n\n```text\n\"@method\": GET\n\"@authority\": api.example\n\"@path\": /orders/123\n\"@signature-params\": (\"@method\" \"@authority\" \"@path\");created=1735689600;alg=\"ed25519\";keyid=\"example-key\"\n```\n\n## [Guides](guides/README.md)\n\nFor sender and recipient integration, cryptographic providers, component selection,\n`Accept-Signature`, Fetch behavior, and security guidance, see the\n[guides directory](guides/README.md).\n\n## Runtime Requirements\n\nThe module requires standards-compatible `Request`, `Response`, and `Headers` implementations. The\nFetch wrappers also require a Fetch implementation. The built-in cryptographic providers require the\nWeb Cryptography API and runtime support for the selected algorithm. The package does not provide\npolyfills.\n\nStructured Field Byte Sequences use `Uint8Array.prototype.toBase64()` and `Uint8Array.fromBase64()`\nwhere they are available, and fall back to `btoa()` and `atob()` where they are not. Both paths\nproduce the same results and are covered by the test suite.\n\nRuntime-specific behavior that affects signatures, such as manual redirect handling in browsers,\nrepeated field lines, trailers, and response reconstruction, is documented in\n[Fetch behavior and limitations](guides/fetch.md).\n\n## Supported Operations\n\n- Sign requests and responses.\n- Verify one or more message signatures against explicit recipient policy.\n- Generate key pairs containing Web Cryptography's `CryptoKey` objects and providers for ECDSA\n  P-256, ECDSA P-384, and Ed25519.\n- Bind a response signature to components of its related request.\n- Create, parse, append, and fulfill `Accept-Signature` requests.\n- Derive RFC 9421 request and response components from Fetch messages.\n- Process HTTP fields as Structured Fields, dictionary members, raw byte sequences, or trailers.\n- Wrap `fetch` with request signing, response verification, or both through independent\n  tree-shakeable exports.\n\n## Cryptographic Algorithms\n\n`fetch-message-signatures` includes tree-shakeable key-pair generators, signer factories, and\nverifier factories backed by Web Cryptography for ECDSA P-256, ECDSA P-384, and Ed25519. Other\nalgorithms and key systems can be supplied through the [`Signer`](docs/interfaces/Signer.md) and\n[`Verifier`](docs/interfaces/Verifier.md) interfaces. Applications choose trusted keys, algorithms,\nand authorization policy.\n\nThe [cryptographic providers guide](guides/cryptography.md) documents the exact algorithm mappings,\nkey extractability, signature parameter handling, and custom provider contract. Exported functions\nare listed under [Cryptographic Algorithms](docs/README.md#cryptographic-algorithms) in the API\nreference.\n\n## Security Considerations\n\nA valid signature authenticates only its covered components. It does not by itself establish\nauthorization, freshness, replay protection, or body integrity. Applications must define trusted\nkeys, required component coverage, timestamp and nonce policy, and independently validate\n`Content-Digest` when body integrity matters.\n\nFetch also hides or normalizes some protocol-layer HTTP details. Read the\n[security guidance](guides/security.md) and [Fetch behavior](guides/fetch.md) before deploying\nsignatures across a network boundary. Security vulnerabilities should be reported according to the\n[Security Policy].\n\n## Specifications\n\n- [HTTP Message Signatures (RFC 9421)][RFC 9421]\n\n[RFC 9421]: https://www.rfc-editor.org/rfc/rfc9421/\n[Security Policy]: https://github.com/panva/fetch-message-signatures/security/policy\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpanva%2Ffetch-message-signatures","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpanva%2Ffetch-message-signatures","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpanva%2Ffetch-message-signatures/lists"}