web-bot-auth - GitLite

KO | EN

gitlite — search

#hacktoberfest #react #ai #typescript #android #rust #nodejs #java #awesome #kubernetes #vue #ios #openai #open-source

web-bot-auth

(★ 148)

Sign and verify orchestrated HTTP requests

파일 탐색기

최종 버전 다운로드 (.zip)

- - publish-npm.yml
  - pullrequest.yml
  - semgrep.yml
- dependabot.yml
- - Cargo.toml
  - README.md
- - Cargo.toml
  - README.md
- - .gitignore
  - LICENSE
  - package.json
  - README.md
- - .gitignore
  - Caddyfile
  - directory.go
  - fetch.go
  - go.mod
  - go.sum
  - handler.go
  - handler_test.go
  - httpsig.go
  - httpsig_test.go
  - LICENSE
  - README.md
  - registry.go
- - .gitignore
  - .python-version
  - LICENSE
  - pyproject.toml
  - README.md
  - uv.lock
- - ed25519.json
  - ed25519.pem
  - ed25519.pub.pem
  - rsapss.json
  - rsapss.pem
  - rsapss.pub.pem
- - Cargo.toml
  - README.md
  - signing.rs
  - verify.rs
  - verify_arbitrary.rs
- - .gitignore
  - Cargo.lock
  - Cargo.toml
  - README.md
  - wrangler.toml
- - .editorconfig
  - .gitignore
  - LICENSE
  - package.json
  - tsconfig.json
  - vitest.config.mts
  - worker-configuration.d.ts
  - wrangler.jsonc
- - LICENSE
  - package.json
  - README.md
  - tsconfig.json
- - package.json
  - README.md
  - tsconfig.json
- - package.json
  - README.md
  - tsconfig.json
.gitignore
.prettierignore
.prettierrc
Cargo.lock
Cargo.toml
CONTRIBUTING.md
LICENSE
package-lock.json
package.json
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/cloudflare/web-bot-auth

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd web-bot-auth

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Node.js

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Node.js npm 명령어를 쓰려면 Node.js가 설치되어 있어야 합니다. LTS(장기지원) 버전을 추천합니다.

npm install

package.json에 명시된 라이브러리들을 내려받아 설치합니다.

npm start

개발/실행 서버를 켭니다.

✅ 명령어 실행 후 터미널에 나타나는 주소(보통 http://localhost:3000 형태)를 브라우저에서 열어보세요.

3. Rust

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Rust (rustup) rustup으로 설치하면 cargo도 함께 설치됩니다.

cargo build --release

Rust 프로젝트를 컴파일합니다.

cargo run

빌드 후 바로 실행까지 진행합니다.

✅ cargo build가 에러 없이 끝나면 성공입니다. target/ 폴더에 실행 파일이 생성됩니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Web Bot Auth

![GitHub License](https://img.shields.io/github/license/cloudflareresearch/web-bot-auth)

This repo contains Web Bot Auth libraries and examples for signed automated HTTP traffic, as described in [draft-meunier-webbotauth-httpsig-protocol](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/).

## Table of Contents

- [Examples](#examples)
- [Development](#development)
- [Security Considerations](#security-considerations)
- [License](#license)

## Examples

### Live deployment

Cloudflare Research provides a live environment at [http-message-signatures-example.research.cloudflare.com](https://http-message-signatures-example.research.cloudflare.com/).

Use this deployment to test an implementation.

1. It validates the presence of a `Signature` header signed [RFC9421 ed25519 test key](./examples/rfc9421-keys/ed25519.pem),
2. It exposes a bot directory on [/.well-known/http-message-signatures-directory](https://http-message-signatures-example.research.cloudflare.com/.well-known/http-message-signatures-directory),
3. It serves debug tools for request signatures, JWK key IDs, and directories.

### Signing

| Example                                            | Description                                  |
| :------------------------------------------------- | :------------------------------------------- |
| [Browser extension](./examples/browser-extension/) | Adds a `Signature` on every outgoing request |
| [Rust](./examples/rust/)                           | Signs a hardcoded test request               |

### Verifying

| Example                                                | Description                                            |
| :----------------------------------------------------- | :----------------------------------------------------- |
| [Cloudflare Workers](./examples/verification-workers/) | Verify RFC 9421 `Signature` for every incoming request |
| [Caddy Plugin](./examples/caddy-plugin/)               | Verify RFC 9421 `Signature` for every incoming request |
| [Rust](./examples/rust/)                               | Verify a sample test request                           |

### HTTP Signature Directories

| Example                                                            | Description                                                                           |
| :----------------------------------------------------------------- | :------------------------------------------------------------------------------------ |
| [Cloudflare Workers](./examples/signature-agent-card-and-registry) | Host a registry, Signature Agent Card, and signed key directory on Cloudflare Workers |

## Development

This repository uses [npm](https://docs.npmjs.com/cli/v11/using-npm/workspaces) and [cargo](https://doc.rust-lang.org/book/ch14-03-cargo-workspaces.html) workspaces. There are several packages which it provides:

| Package                                                        | Language   | Description                                                                                                                                                                   |
| :------------------------------------------------------------- | :--------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [http-message-sig](./packages/http-message-sig/)               | TypeScript | HTTP Message Signatures as defined in RFC 9421                                                                                                                                |
| [jsonwebkey-thumbprint](./packages/jsonwebkey-thumbprint/)     | TypeScript | JWK Thumbprint as defined in RFC 7638                                                                                                                                         |
| [web-bot-auth](./packages/web-bot-auth/)                       | TypeScript | HTTP Message Signatures for Bots as defined in [draft-meunier-webbotauth-httpsig-protocol-00](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/00/) |
| [web-bot-auth](./crates/web-bot-auth/)                         | Rust       | HTTP Message Signatures for Bots as defined in [draft-meunier-webbotauth-httpsig-protocol-00](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/00/) |
| [http-signature-directory](./crates/http-signature-directory/) | Rust       | Validates whether an HTTP message signature directory is correctly signed and valid                                                                                           |

## Security Considerations

This software has not been audited. Please use at your sole discretion.

## License

This project is under the Apache 2.0 license.

### Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be Apache 2.0 licensed as above, without any additional terms or conditions.