Directory response self-signature

What this check verifies

The directory draft recommends that the directory response itself is signed: one HTTP Message Signature per key in the set, made with that key, attached to the response as Signature and Signature-Input headers. Each signature covers "@authority";req (the authority of the request that fetched the directory, the req flag marks a request component on a response signature) and carries created, expires, a thumbprint keyid, and the tag http-message-signatures-directory.

This check reads those response headers and verifies the signatures against the keys in the directory body:

• No Signature/Signature-Input on the response: advisory warning (the draft says RECOMMENDED, not MUST).
• At least one signature verifies against a directory key: pass.
• Signatures present but none verify: fail, because a broken self-signature is worse than none.

It never caps the grade and never changes the verdict.

Why it matters

The self-signature proves possession: whoever serves the directory also holds the private keys it advertises. Without it, anyone can mirror your key set at their own well-known path and pose as the operator of those keys; the keys are public, after all. A verifier that validates the response signature, and the draft says clients SHOULD, can ignore keys that arrive without proof of possession, which shuts down mirrored and misattributed directories.

Because the signature covers the request’s authority, a captured response cannot be replayed for a different host either: the base includes the authority the fetcher actually asked for.

How to fix it

1. Sign the directory response with each key in the set at serve time. The reference TypeScript library exposes exactly this: directoryResponseHeaders(message, signers, { created, expires }) from the web-bot-auth package returns the two headers to attach.
2. Use the tag http-message-signatures-directory (the library sets it) and a thumbprint keyid, and keep the window short; the headers are computed per response, so a few minutes is plenty.
3. A static file host cannot set per-request signatures. Serve the well-known path from a small handler (a Worker or equivalent) when you want this pass; until then the check stays an advisory warning.

This site’s own directory does this; check webbotauth.net and compare the response headers.

References

• The web-bot-auth directory draft (draft-meunier-http-message-signatures-directory) defines the response signing mechanism, tag, and validation guidance.
• RFC 9421 defines response signatures and the req component flag.
• How grading works explains how advisory checks affect the score.