<![CDATA[Question about HTTP Signatures in #ActivityPub, IIUC the header is a digest of the HTTP body.]]>Question about HTTP Signatures in , IIUC the header is a digest of the HTTP body. Given that JSON is not white-space sensitive, does that mean that storing the response must preserve the indentation used by the server?

]]>https://bb.devnull.land/topic/98fe4d1d-ac3d-4f79-aa5e-968ba1bc722f/question-about-http-signatures-in-activitypub-iiuc-the-header-is-a-digest-of-the-http-body.RSS for NodeSun, 21 Jun 2026 09:28:44 GMTWed, 17 Jun 2026 23:09:57 GMT60<![CDATA[Reply to Question about HTTP Signatures in #ActivityPub, IIUC the header is a digest of the HTTP body. on Thu, 18 Jun 2026 19:52:42 GMT]]>@PuercoPop I think HTTP signatures are not good for that, but you can put a signature inside an activity:

https://fediverse.codeberg.page/fep/fep/8b32/

"integrity proofs" proposed in this document use JSON Canonicalization Scheme, which is not whitespace-sensitive.

]]>https://bb.devnull.land/post/https://mitra.social/objects/019edc4a-fc0e-74c1-9837-1df5d369c584https://bb.devnull.land/post/https://mitra.social/objects/019edc4a-fc0e-74c1-9837-1df5d369c584Thu, 18 Jun 2026 19:52:42 GMT<![CDATA[Reply to Question about HTTP Signatures in #ActivityPub, IIUC the header is a digest of the HTTP body. on Thu, 18 Jun 2026 19:31:04 GMT]]>@silverpill Sorry for being imprecise, I meant the response as the response body, not the entire HTTP response. I'm wondering if having white-space sensitive JSON means one can't use JSONB to store the response.

What I'm trying to understand is if the HTTP signature is useful to provide a way for users/clients to verify the integrity of the activity, similar to how sha256.sum is used in software distribution.

]]>https://bb.devnull.land/post/https://mastodon.social/users/PuercoPop/statuses/116772769918258209https://bb.devnull.land/post/https://mastodon.social/users/PuercoPop/statuses/116772769918258209Thu, 18 Jun 2026 19:31:04 GMT<![CDATA[Reply to Question about HTTP Signatures in #ActivityPub, IIUC the header is a digest of the HTTP body. on Thu, 18 Jun 2026 14:38:59 GMT]]>@PuercoPop Yes, but why do you want to store the response? HTTP signatures are not supposed to be re-used.

]]>https://bb.devnull.land/post/https://mitra.social/objects/019edb2b-c503-7b73-a7b4-02b85ecf42d4https://bb.devnull.land/post/https://mitra.social/objects/019edb2b-c503-7b73-a7b4-02b85ecf42d4Thu, 18 Jun 2026 14:38:59 GMT