Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
httpSignature
✓ import httpSignature from 'http-signature'
✗ const httpSignature = require('http-signature').default;
This library is primarily CommonJS-first. While a default import might work in some transpiled ESM environments, the `require` statement accessing the module directly is the most reliable. No explicit ESM support is declared or evident.
sign
✓ const httpSignature = require('http-signature');
httpSignature.sign(req, options);
✗ import { sign } from 'http-signature';
The `sign` function is a method of the default exported `httpSignature` object. Direct named imports are not supported.
parseRequest
✓ const httpSignature = require('http-signature');
httpSignature.parseRequest(req);
✗ import { parseRequest } from 'http-signature';
Like `sign`, `parseRequest` is a method of the default exported `httpSignature` object; it is not a named export.
Demonstrates both client-side request signing and server-side signature verification using `http-signature` for a basic HTTPS request. It shows how to use `sign`, `parseRequest`, and `verifySignature` functions.
const fs = require('fs');
const https = require('https');
const httpSignature = require('http-signature');
// In a real application, manage keys securely, e.g., via environment variables or a KMS.
// For this example, create dummy key.pem and cert.pem files.
// echo '-----BEGIN RSA PRIVATE KEY-----
// ...your-private-key...
// -----END RSA PRIVATE KEY-----' > key.pem
// echo '-----BEGIN CERTIFICATE-----
// ...your-certificate...
// -----END CERTIFICATE-----' > cert.pem
const key = fs.readFileSync('./key.pem', 'ascii');
const options = {
host: 'localhost',
port: 8443,
path: '/',
method: 'GET',
headers: {}
};
const req = https.request(options, function(res) {
console.log('Client received status code:', res.statusCode);
res.on('data', (d) => process.stdout.write(d));
res.on('end', () => console.log('\nClient request complete.'));
});
httpSignature.sign(req, {
key: key,
keyId: 'client-key-id',
keyPassphrase: process.env.KEY_PASSPHRASE ?? '' // Optional, if key is encrypted
});
req.end();
// --- Server-side (for testing the client) ---
const serverOptions = {
key: fs.readFileSync('./key.pem'),
cert: fs.readFileSync('./cert.pem')
};
https.createServer(serverOptions, function (serverReq, serverRes) {
let responseCode = 200;
try {
const parsed = httpSignature.parseRequest(serverReq);
// For a real server, 'pub' would come from a trusted source based on parsed.keyId
const pub = fs.readFileSync('./cert.pem', 'ascii'); // Using the same cert for simplicity
if (!httpSignature.verifySignature(parsed, pub)) {
responseCode = 401; // Unauthorized
console.error('Server: Signature verification failed!');
} else {
console.log('Server: Signature verified successfully for keyId:', parsed.keyId);
}
} catch (e) {
responseCode = 500;
console.error('Server error processing signature:', e.message);
}
serverRes.writeHead(responseCode, { 'Content-Type': 'text/plain' });
serverRes.end(responseCode === 200 ? 'Hello from signed server!' : 'Authentication failed.');
}).listen(8443, () => console.log('Server listening on port 8443...'));
Errors
Common errors & fixes
Invalid Signature
The generated signature does not match the one expected by the server, often due to mismatched keys, incorrect algorithms, altered payloads, or clock skew.
fixEnsure correct private/public key pairs are used on client/server, the same signing algorithm is configured, and all signed headers match precisely. Check for payload modifications in transit or significant time differences between client and server.
TypeError: Cannot read properties of undefined (reading 'keyId')
The `httpSignature.parseRequest()` function returned `undefined` or an incomplete object, indicating an issue parsing the incoming HTTP request's Signature header.
fixInspect the incoming request's `Authorization` or `Signature` header to ensure it's present, correctly formatted, and adheres to the expected HTTP Signature scheme parameters (keyId, algorithm, headers, signature).
Error: Missing or malformed signature header
The incoming HTTP request lacks a properly formed 'Authorization: Signature ...' or 'Signature: ...' header as required by the HTTP Signature specification.
fixEnsure the client is adding the `Authorization: Signature` header with all required parameters (keyId, algorithm, headers, signature) to the HTTP request before sending it.
Audit
Dependencies
No dependency data recorded yet.