[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA2QWn-48utqJRAVqcW7YsxhwUlQdf7-tOzWarJPPNFQ":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"8ff31c62-960a-49d5-a268-7b4e197502b0","article","HTTP Message Signatures：经过代理转发后，怎样验证请求没被改？","http-message-signatures-integrity","HTTP 消息签名可对选定方法、URI 和头部等组件建立跨连接的完整性证据。本文说明签名覆盖范围、正文摘要、密钥信任和防重放设计，避免把它误认为自动加密整份 HTTP 请求。","HTTPS 能保护浏览器与某个服务器之间的连接，但请求经过代理、网关或消息队列后，原始 TLS 连接可能早已结束。下游系统怎样确认请求中的关键字段确实来自上游、而且在转发过程中没有被改动？HTTP Message Signatures（HTTP 消息签名）让发送方可以对选定的 HTTP 组件计算数字签名或消息认证码。\n\n与“把整个 HTTP 报文原样签名”不同，这套机制会根据规范定义的规则构造待签名内容：例如方法、目标 URI、特定头部、时间戳或请求标识。签名随消息传递，接收方按相同规则重建签名输入，再使用共享密钥或公钥验证。这样即使请求跨越多个 TLS 连接，最终系统仍可核对被选择字段是否保持一致。\n\n“被选择”是最重要的限制。签名只覆盖发送方明确纳入签名基底（signature base）的组件；未包含的头部或字段可以被中间节点修改，而验证仍通过。更容易忽略的是，请求正文通常不会因为签了几个头部就自动受到保护。若要保证正文完整性，设计通常还要先计算内容摘要，并把摘要字段纳入签名。\n\n签名机制也不替应用决定信任谁。系统要配置密钥身份、算法、有效期、可接受的签名覆盖范围以及失败处理方式。若验证方拿错了公钥，或允许过宽的算法集合，签名可能失去意义；如果请求被原样重放，单纯的签名仍可能有效，因此时间戳、随机数、请求 ID 和业务幂等策略常用于防重放。\n\n可以把它想成给一份公文盖骑缝章：章能证明指定页和指定字段未被替换，但如果没有把附件清单也纳入验证，附件依然可能被调包。HTTP 消息签名的强项是跨连接、跨代理保留端到端的完整性证据；它不会自动加密内容，也不会自动证明业务请求合理。\n\n在微服务、支付请求、Webhook 或代理链路中，消息签名可让接收方不必完全依赖最近一跳的 TLS 连接，而是验证更早的发送方声明。落地时应先明确“哪些部分必须防改”，再写出稳定、最小但充分的签名配置，并用篡改、过期和重放测试验证整个链路。\n\n来源：[IETF RFC 9421：HTTP Message Signatures](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9421.html)","\u002Fuploads\u002F2026-10-13\u002Fb40e0381-b556-4a40-b504-e3ad05dedca7.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"Internet Engineering Task Force","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9421.html","published",false,45,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:14:00.248Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":42,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T02:13:55.563Z"]