Skip to content

fix(web-bot-auth): reject duplicate covered components - #158

Open
thibmeu wants to merge 1 commit into
cloudflare:mainfrom
thibmeu:reject-duplicate-components
Open

thibmeu wants to merge 1 commit into
cloudflare:mainfrom
thibmeu:reject-duplicate-components

Conversation

@thibmeu

@thibmeu thibmeu commented Oct 16, 2026

Copy link
Copy Markdown
Member

RFC 9421 Section 2.5, step 2.1: each component identifier occurs only once. Parsing collected components into an IndexMap, silently dropping repeats, so a Signature-Input with a duplicated identifier verified against the signature over the de-duplicated base.

@thibmeu
thibmeu requested a review from AkshatM October 16, 2026 22:26
@thibmeu thibmeu self-assigned this Oct 16, 2026
@thibmeu thibmeu added the bug Something isn't working label Oct 16, 2026
RFC 9421 Section 2.5, step 2.1: each component identifier occurs only
once. Parsing collected components into an IndexMap, silently dropping
repeats, so a Signature-Input with a duplicated identifier verified
against the signature over the de-duplicated base.
@thibmeu
thibmeu force-pushed the reject-duplicate-components branch from 33aedfd to e928c53 Compare October 19, 2026 16:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant