Download the PHP package craftcms/http-message-signatures without Composer
On this page you can find all versions of the php package craftcms/http-message-signatures. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package http-message-signatures
HTTP Message Signatures (RFC 9421)
A PHP 8.1+ implementation of HTTP Message Signatures as specified in RFC 9421.
Features
- ✅ RFC 9421 signing and verification support
- ✅ PSR-7 compliant - Works with any PSR-7 HTTP message implementation
- ✅ Support for multiple signature algorithms:
- HMAC-SHA256
- RSA-SHA256
- Ed25519
- ✅ Signature creation and verification
- ✅ Structured fields parsing for
signature-inputandsignatureheaders - ✅ Component derivation (headers, query parameters, request target, etc.)
- ✅ Immutable message handling (respects PSR-7 immutability)
Installation
Requirements
- PHP 8.1 or higher
- PSR-7 HTTP message implementation (e.g.,
guzzlehttp/psr7,nyholm/psr7,slim/psr7)
Dependencies
This package uses well-maintained, industry-standard libraries:
- bakame/http-structured-fields - For parsing and formatting HTTP Structured Fields (RFC 8941) used in signature headers
Usage
Creating a Signature
Verifying a Signature
Signing URLs
Use UrlSigner and UrlVerifier when the signature needs to live in the URL instead of HTTP headers.
RFC 9421 does not define a signed URL format. This package provides URL signing as a convenience API that applies the same component derivation, signature base, parameters, and algorithms to a URL-carried signature.
Signed URLs only include the configured signature query parameter. The component list and signature parameters are verifier policy, so the signer and verifier must be configured with the same UrlSigningConfig.
By default, URL signatures cover @target-uri, append a signature query parameter, and omit created/expires. Configure components, signatureParam, created, expiresAfter, keyid, nonce, or tag when those values are part of your URL signing policy.
When signing or verifying non-GET URLs, pass a PSR-7 RequestInterface so the request method can be included with @method.
Using RSA-SHA256
Using Ed25519
Available Components
The following components can be included in signatures:
Derived Components:
@method- HTTP method@path- Request path@query- Query string@authority- Host and port@scheme- URI scheme@target-uri- Full URI@request-target- Request target@status- Response status code (for responses)
Headers:
- Any header name (e.g.,
content-type,date,authorization)
Query Parameters:
@query-param;name="paramname"- Specific query parameter
PSR-7 Compliance
This package is fully PSR-7 compliant:
- Works with any PSR-7 implementation (
guzzlehttp/psr7,nyholm/psr7,slim/psr7, etc.) - Respects PSR-7 immutability - all methods return new message instances
- Uses only PSR-7 interfaces (
MessageInterface,RequestInterface,ResponseInterface) - No direct dependencies on specific PSR-7 implementations
Testing
Code Quality
License
MIT
All versions of http-message-signatures with dependencies
bakame/http-structured-fields Version ^2.0
league/uri-components Version ^7.0
psr/http-factory Version ^1.0
psr/http-message Version ^2.0