I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the solution is the HTTP request normalization. (Use of HTTP is a condition, since this is the most realistic usage scenario these days.)

Basically, I need to answer the question "How do I turn any incoming HTTP request into a normalized signature base string so that I can compute a signature?" (my current approach is here).

Are there any standard ways to solve this task?

If not, how would you go around the issue? Should I include HTTP headers or focus only on URL, method and body? Should I pay attention to the corner cases, such as duplicate GET parameters? etc.

  • $\begingroup$ It seems this question is better suited for Security, since it is concerned with how to deal with the internals of HTTP in the context of a security protocol. There is basically no cryptographic theory involved, which is what this site is about. $\endgroup$ – yyyyyyy May 13 '16 at 12:46
  • $\begingroup$ @yyyyyyy, OTOH, it is a question about cryptographic standards. I'd keep it here. $\endgroup$ – otus May 13 '16 at 13:14
  • $\begingroup$ Thank you for fixing the tags - I agree this is more of an auxiliary topic... $\endgroup$ – Petr Dvořák May 13 '16 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.