http-signature

• Add keyPassphrase option to signer (#115)
• Add support for created and expires values (#110)

version 1.3.4 (2020-04-02)

version 1.3.3 (2020-04-01)

version 1.3.2 (2020-02-24)

version 1.3.1 (2019-11-05)

Known issue: This release broken http-signature with node 0.10.

• Bump dependency sshpk
• Add Signature header support (#83)

• Bump dependency assert-plus
• Add ability to pass a custom header name
• Replaced dependency node-uuid with uuid

• Version of dependency assert-plus updated: old version was missing some license information
• Corrected examples in http_signing.md, added auto-tests to automatically validate these examples

• Bump version of sshpk dependency, remove peerDependency on it since it now supports exchanging objects between multiple versions of itself where possible

• Bump min version of jsprim dependency, to include fixes for using http-signature with browserify

• Bump minimum version of sshpk dependency, to include fixes for whitespace tolerance in key parsing.

• First semver release.
• #36: Ensure verifySignature does not leak useful timing information
• #42: Bring the library up to the latest version of the spec (including the request-target changes)
• Support for ECDSA keys and signatures.
• Now uses sshpk for key parsing, validation and conversion.
• Fixes for #21, #47, #39 and compatibility with node 0.8

• Split up HMAC and Signature verification to avoid vulnerabilities where a key intended for use with one can be validated against the other method instead.