Download the PHP package rysonliu/http-signature without Composer

On this page you can find all versions of the php package rysonliu/http-signature. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package http-signature

HTTP Signature service and middleware (PHP)

Build Status Scrutinizer Code Quality Code Coverage Packagist Stable Version Packagist License

This library provides a service for implementing the IETF HTTP Signatures draft RFC. It includes PSR-7 compatible middleware for signing requests (by an HTTP client like Guzzle) and verifying http signatures.

Installation

composer require rysonliu/http-signature

Usage

When creating the HttpSignature service, pass a list of supported algorithms, a callback to sign request and a callback to verify signatures.

Signing request

You can use the service to sign a PSR-7 Request.

Verifying requests

You can use the service to verify the signature of a signed a PSR-7 Request.

If the request is not signed, the signature is invalid, or the request doesn't meet the requirements, an HttpSignatureException is thrown.

Configuring the service

Multiple algorithms

Rather than specifying a single algorithm, an array of supported algorithms may be specified in the constructor. The used algorithm is passed as extra parameter to the sign and verify callbacks.

When signing, specify the algorithm;

Alternatively you can get a copy of the service with one of the algorithms selected.

Required headers

By default, the request target (includes the HTTP method, URL path and query parameters) and the Date header are required to be part of the signature message for all types of requests.

The required headers can be specified per request method or as default.

Note that the requirement only applies on including the headers to create the signature. If the headers are not used in the request, they are also not part of the signature. Checking if headers are set in the request and have a valid value, is outside the scope of this library.

Date header

If a Date header is specified, the service will check the age of the request. If it's signed to long ago an exception is thrown. By default a request may not be more than 300 seconds (5 minutes) old.

The time between signing a request and verifying it, may be due to latency or the system clock of client and/or server might be off.

The time that is allowed can be configured as clock skew;

X-Date header

Browsers automatically set the Date header for AJAX requests. This makes it impossible to use this for the signature. As solution, an X-Date header may be used that supersedes the Date header.

Server middleware

Server middleware can be used to verify PSR-7 requests.

If the request is signed but the signature is invalid, the middleware will return a 401 Unauthorized response and the handler will not be called.

Single pass middleware (PSR-15)

The middleware implements the PSR-15 MiddlewareInterface. As PSR standard many new libraries support this type of middleware, for example Zend Stratigility.

You're required to supply a PSR-17 response factory, to create a 401 Unauthorized response for requests with invalid signatures.

Double pass middleware

My PHP libraries support double pass middleware. These are callables with the following signature;

To get a callback to be used by libraries as Jasny Router and Relay, use the asDoublePass() method.

When using as double pass middleware, the supplying a resource factory is optional. If not supplied, it will use the response passed when invoked.

Verifying requests

If a request is signed and the signature is valid, the middle with set a signature_key_id request attribute.

For requests that are not signed, the middleware does nothing. This means that you need to always check if the request has the signature_key_id.

Client middleware

Client middleware can be used to sign requests send by PSR-7 compatible HTTP clients like Guzzle and HTTPlug.

The $keyId is used to the Authorization header and passed to the sign callback.

If the service supports multiple algorithms you need to use the withAlgorithm method to select one.

Double pass middleware

The client middleware can be used by any client that does support double pass middleware. Such middleware are callables with the following signature;

Most HTTP clients do not support double pass middleware, but a type of single pass instead. However more general purpose PSR-7 middleware libraries, like Relay, do support double pass.

The client middleware does not conform to PSR-15 (single pass) as that is intended for server requests only.

Guzzle

Guzzle is the most popular HTTP Client for PHP. The middleware has a forGuzzle() method that creates a callback which can be used as Guzzle middleware.

When using the middleware for Guzzle, it's not required to pass a $keyId to the constructor. Instead use Guzzle option signature_key_id. This also allows the option use different keys per request or disable signing for requests.

Alternatively, you can disable signing by default and only sign when specified;

Using an option is only available for Guzzle. For HTTPlug and other clients, you need to create a client per key or sign without the use of middleware.

HTTPlug

HTTPlug is the HTTP client of PHP-HTTP. It allows you to write reusable libraries and applications that need an HTTP client without binding to a specific implementation.

The forHttplug() method for the middleware creates an object that can be used as HTTPlug plugin.


All versions of http-signature with dependencies

PHP Build Version
Package Version
Requires php Version >=7.2.0
improved/improved Version ^0.1.0
nesbot/carbon Version ^2.12
psr/http-factory Version ^1.0
psr/http-message Version ^1.1 || ^2.0
psr/http-server-handler Version ^1.0
psr/http-server-middleware Version ^1.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package rysonliu/http-signature contains the following files

Loading the files please wait ....