Skip to main content

Signature Verification

Request signing and verification for application authentication.

Signature Process​

TODO: Document signature process:

Signing (Application)​

  1. Create signature payload (method, timestamp, request hash)
  2. Sign with private key
  3. Include signature in request metadata

Verification (AppServer)​

  1. Extract signature from metadata
  2. Validate certificate
  3. Extract public key
  4. Verify signature matches payload
  5. Check timestamp within replay window

Replay Protection​

Prevents replay attacks by checking request timestamps.

Replay Window​

  • APPSERVER_SIGNATURE_REPLAY_WINDOW (default: 5m)
  • Requests older than window are rejected

Clock Skew Tolerance​

  • APPSERVER_CLOCK_SKEW_TOLERANCE (default: 30s)
  • Allows for time differences between systems

Signature Algorithms​

TODO: Document supported algorithms:

  • RSA-SHA256
  • ECDSA-SHA256

Best Practices​

TODO: Document best practices:

  • Use NTP to sync clocks
  • Monitor replay window hits
  • Log signature failures
  • Rotate keys regularly