A digest header is an HTTP header containing a Base64-encoded hash of the request body. It summarizes potentially large content so request fingerprints can preserve body integrity without signing the entire payload. section 30.3.4
Use a digest header as part of a signed-request workflow:
- Generate a SHA-256 hash from the exact request body and encode the result in Base64, producing a value such as `SHA-256=...`. section 30.3.4
- Include `digest` among the ordered components of the request fingerprint alongside the target, host, and date. section 30.3.4
- Send the digest with a signature header; the signature covers the fingerprint, while the digest binds that fingerprint to the body. section 30.3.5
- During verification, recompute the digest and reject the request when it differs from the received header. section 30.3.6
Signed chat-room update
A `PATCH /chatRooms/1` request with body `{"title":"New title"}` carries `Digest: SHA-256=HV9PltG0QPRNsl1FB7ebQA8XPasvPyRg6hhU0QF2l4M=`. The digest appears in the fingerprint and is covered by the accompanying signature. section 30.3.5
Listing 30.4 Generating the hash value for a digest header
const crypto = require('crypto');
function generateDigestHeader(body: string): string {
return 'SHA-256=' + crypto #1
.createHash('sha256')
.update(body)
.digest()
.toString('base64'); #2
}
Inspect the compact Node.js implementation that hashes the body and formats the digest header. section 30.3.4
