Consider supporting RFC 9421 HTTP Message Signatures #18502
Description
Expected Behavior
RFC 9421 HTTP Message Signatures defines a standard mechanism to create and verify digital signature or MAC at HTTP message level. It could be useful when people want to design a system with webhooks without mTLS.
Spring Security could consider adding RFC 9421 support for both servers and clients:
- For servers:
- Implement RFC 9421 signature verification as a new authentication mechanism
- Provide abstractions for signature credentials management
- For clients: Provide RestClient interceptor and WebClient filter function to create RFC 9421 signature
Current Behavior
Currently, Spring Security doesn't support RFC 9421.
Context
The adoption of RFC 9421 is still emerging. Existing popular webhook-supporting platforms such as GitHub define their ad-hoc webhook signature verification mechanism. If Spring Security as a popular framework supported RFC 9421, it could promote the adoption of this shared standard mechanism.