Caddy plugin extending Caddy configuration to allow for validation of web-bot-auth as defined in draft-meunier-webbotauth-httpsig-protocol.

• Features
• Usage
• Security Considerations
• License

This is an example plugin and only supports Ed25519. You can find a test key in Appendix B.1.4 of RFC 9421.

• httpsig configuration hook
• Load keys from a direct HTTP Message Signatures directory with directory_base
• Load keys from registry signature-agent cards with registry
• Load multiple inline keys, or multiple keys from jwks_uri
• Load IP allowlists from ips_uri as defined in draft-illyes-webbotauth-jafar-00
• Block request without a valid signature

First, you need to install xcaddy

go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest

Then you build caddy

xcaddy build latest --with github.com/cloudflareresearch/web-bot-auth/examples/caddy-plugin=./

And finally, you run caddy

./caddy run --config Caddyfile

To generate a signed request, you can use the sibling browser extension.

directory_base is the direct directory mode. registry is experimental registry draft support and can be repeated. fail_on_load_error defaults to false; set it to true if Caddy should fail provisioning when directories, registries, cards, IP lists, or keys cannot be loaded.

This software has not been audited. Please use at your sole discretion.

This project is under the Apache 2.0 license.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be Apache 2.0 licensed as above, without any additional terms or conditions.