# http-signature

> Reference implementation of Joyent's HTTP Signature scheme.

Latest version **1.4.0** (published 2023-11-15) · MIT license · 0 weekly downloads

## Install

```sh
npm install http-signature
pnpm add http-signature
yarn add http-signature
bun add http-signature
```

## Health

**Score 23/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.4.0 |
| Published | 2023-11-15 |
| First published | 2011-07-14 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/http-signature) |
| Module format | CommonJS |
| Node | >=0.10 |
| Dependencies | 3 |
| Unpacked size | 37.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 404 |
| Author | MNX Cloud |
| Maintainers | bahamat, todd.whiteman, kusor, michael.hicks, pfmooney, mcavage, arekinath, melloc |
| Keywords | https, request |

## Links

- npm: https://www.npmjs.com/package/http-signature
- Repository: https://github.com/TritonDataCenter/node-http-signature
- Homepage: https://github.com/TritonDataCenter/node-http-signature/
- Issues: https://github.com/TritonDataCenter/node-http-signature/issues
- npm.io page: https://npm.io/package/http-signature

## Dependencies (3)

- [sshpk](https://npm.io/package/sshpk.md) ^1.18.0
- [jsprim](https://npm.io/package/jsprim.md) ^2.0.2
- [assert-plus](https://npm.io/package/assert-plus.md) ^1.0.0

## Alternatives

- [launchdarkly-js-client-sdk](https://npm.io/package/launchdarkly-js-client-sdk.md) — 2.5M weekly downloads
- [@elastic/elasticsearch](https://npm.io/package/@elastic/elasticsearch.md) — 2.1M weekly downloads
- [@c8y/client](https://npm.io/package/@c8y/client.md) — 15.3K weekly downloads
- [@signaldb/maverickjs](https://npm.io/package/@signaldb/maverickjs.md) — 1.7K weekly downloads
- [@bbc/http-transport-cache](https://npm.io/package/@bbc/http-transport-cache.md) — 1.2K weekly downloads

## Recent versions

- 1.4.0 (latest) — 2023-11-15
- 1.3.6 — 2021-11-17
- 1.3.5 — 2020-09-23
- 1.3.4 — 2020-04-02
- 1.3.3 — 2020-04-01
- 1.3.2 — 2020-02-24
- 1.3.1 — 2019-11-05
- 1.3.0 — 2019-11-05
- 1.2.0 — 2017-08-25
- 1.1.1 — 2016-01-25
- 1.1.0 — 2015-11-18
- 1.0.2 — 2015-10-16
- 1.0.1 — 2015-10-15
- 1.0.0 — 2015-10-14
- 0.11.0 — 2015-04-02
- … 13 more at https://npm.io/package/http-signature/versions

## README

# node-http-signature

node-http-signature is a node.js library that has client and server components
for Joyent's [HTTP Signature Scheme](http_signing.md).

## Usage

Note the example below signs a request with the same key/cert used to start an
HTTP server. This is almost certainly not what you actually want, but is just
used to illustrate the API calls; you will need to provide your own key
management in addition to this library.

### Client

```js
var fs = require('fs');
var https = require('https');
var httpSignature = require('http-signature');

var key = fs.readFileSync('./key.pem', 'ascii');

var options = {
  host: 'localhost',
  port: 8443,
  path: '/',
  method: 'GET',
  headers: {}
};

// Adds a 'Date' header in, signs it, and adds the
// 'Authorization' header in.
var req = https.request(options, function(res) {
  console.log(res.statusCode);
});


httpSignature.sign(req, {
  key: key,
  keyId: './cert.pem',
  keyPassphrase: 'secret' // (optional)
});

req.end();
```

### Server

```js
var fs = require('fs');
var https = require('https');
var httpSignature = require('http-signature');

var options = {
  key: fs.readFileSync('./key.pem'),
  cert: fs.readFileSync('./cert.pem')
};

https.createServer(options, function (req, res) {
  var rc = 200;
  var parsed = httpSignature.parseRequest(req);
  var pub = fs.readFileSync(parsed.keyId, 'ascii');
  if (!httpSignature.verifySignature(parsed, pub))
    rc = 401;

  res.writeHead(rc);
  res.end();
}).listen(8443);
```

## Installation

    npm install http-signature

## License

MIT.

## Bugs

See <https://github.com/joyent/node-http-signature/issues>.

---
_Source: https://npm.io/package/http-signature · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._