[Web-bot-auth] Re: Jumping on the bandwagon: Implementation Report(s)

[Mark Nottingham <[e-mail]>]

Hi Thibault,

> On 8 Oct 2026, at 4:19 am, Thibault Meunier <ot-ietf=[e-mail]> wrote:
[...]
> Would the following under 5.3 Requesting a message signature work?
> 
> """
> - An Origin MAY choose to request signatures from clients that did not initially provide them.
> + An Origin that expects a signature SHOULD request one from clients that did not provide it.
> """
> 
> In addition to simplifying 6.11 Unsigned request, we could have a short paragraph in Appendix C on Deployment guidance
> 
> """
> C.XX Signing conditionally
> 
> Agents can sign every request, or only when an origin requests a signature ({{requesting-message-signature}}). Signing only when an origin asks for it adds a round trip, and non-idempotent requests may not be safely retried.
> """

Looks good, but probably something like "... and non-idempotent requests cannot be automatically retried without additional protocol mechanisms; see {{Section 9.2.2 of HTTP}}."

Something like this might also help in 5.3:

"""
An Origin can refuse requests that do not have valid signatures with an appropriate HTTP status code; usually 403 (Forbidden), per Section 15.5.4 of [HTTP]. When doing so, the Origin SHOULD include the Accept-Signature field (Section 5 of [HTTP-MESSAGE-SIGNATURES]) to indicate what signatures would result in the request being accepted. 

An Origin can also still accept requests that do not have valid signatures, but indicate that the result would be different if one were present by sending the Accept-Signature field in the successful response.

Origins that do not send Accept-Signature in either of these cases SHOULD NOT rely on the presence of signatures in requests unless there is a private arrangement between both parties to do so. Such arrangements need to specify when and how signatures are sent in detail.
"""


> I'd be interested to hear more, if you have time. While the protocol has not changed _much_, there are some changes and being able to track deployment would be useful. I'm not sure how to best to that beyond asking folks what they've deployed and tracking requests that are received, infering the draft version.
> 
> There might be space for an error header "it seems you sent me a signature. i could not verify it. this is is why".

Maybe. Or <https://www.rfc-editor.org/info/rfc9457/>.

Cheers,

--
Mark Nottingham   https://mnot.net/