pub struct Delivery<'a> { /* private fields */ }Expand description
One delivery from a provider, exactly as it arrived.
Headers and bytes, and nothing parsed: a signature is over the bytes the
provider sent, and a body that has been through a JSON parser and back is
a different sequence of bytes that will not verify. A web framework hands
the body over as &[u8] before anything else touches it, and that is what
belongs here.
Header names are matched without regard to case, because HTTP/2 lowercases them and HTTP/1.1 does not.
Implementations§
Source§impl<'a> Delivery<'a>
impl<'a> Delivery<'a>
Sourcepub const fn new(headers: &'a [(&'a str, &'a str)], body: &'a [u8]) -> Self
pub const fn new(headers: &'a [(&'a str, &'a str)], body: &'a [u8]) -> Self
Holds a delivery’s headers and its body.
Sourcepub fn header(&self, name: &str) -> Option<&'a str>
pub fn header(&self, name: &str) -> Option<&'a str>
The first header with this name, ignoring case.
For anything a signature depends on, use
Delivery::signed_header instead: this one answers the first of two
and says nothing about the second.
Sourcepub fn signed_header(
&self,
name: &str,
) -> Result<Option<&'a str>, RepeatedHeader>
pub fn signed_header( &self, name: &str, ) -> Result<Option<&'a str>, RepeatedHeader>
The header with this name, refusing a delivery that carries two.
Ok(None) is a delivery that carries none, which is the caller’s own
error to phrase — a header that is merely absent and one that is
contradicted are different failures and deserve different words.
§Why this exists
A signature is a claim about one delivery, and two headers making that claim are two claims. Whichever a verifier picks, something in front of it — a proxy, a load balancer, whatever wrote the second — picked differently, and the pair of them no longer agree about what was signed. That disagreement is the whole of a header-smuggling attack, and the only safe reading of it is that this delivery cannot be trusted.
It costs nothing to refuse: no provider here sends a signature header twice, so a delivery that carries two did not come from them intact.