I am working on PowerAuth 2.0, a solution for counter-based signing of HTTP requests (for the purpose of mobile banking). One of the tasks that I solved somehow but I am still not happy with the solution is the HTTP request normalization. (Use of HTTP is a condition, since this is the most realistic usage scenario these days.)
Basically, I need to answer the question "How do I turn any incoming HTTP request into a normalized signature base string so that I can compute a signature?" (my current approach is here).
Are there any standard ways to solve this task?
If not, how would you go around the issue? Should I include HTTP headers or focus only on URL, method and body? Should I pay attention to the corner cases, such as duplicate GET parameters? etc.