curl 8.22 Adds HTTP Message Signatures: Test Proxy Paths Before Adoption

curl 8.22.0, released on September 2, 2026, adds experimental support for RFC 9421 HTTP Message Signatures. The command-line client can sign selected request components with Ed25519 or HMAC-SHA256, while libcurl exposes corresponding authentication and signature options.

The feature gives API and automation teams a new way to let a recipient verify selected properties of an HTTP request. It does not make a proxy route automatically trustworthy, and curl’s own documentation warns that the feature is experimental and should not yet be used in production. Teams that combine curl with forward proxies, secure tunnels, regional egress, retries, or redirects should first verify exactly which request is signed and which request reaches the verifier.

What curl 8.22 actually added

The new command-line options cover four inputs:

• the signing algorithm;
• the signing key or key file;
• the key identifier presented to the verifier;
• the derived components and request headers included in the signature.

If no component list is supplied, curl signs the method, authority, path, and the query when one is present. A custom list can include derived components and explicitly supplied headers. According to the curl documentation, header components are taken from headers provided explicitly through the command line. A header curl adds automatically is not signed merely because it appears on the wire.

That distinction is important for reproducibility. If an application expects the user agent, content type, or content digest to be protected, it should set and select that component deliberately, then confirm the verifier uses the same interpretation.

Why proxy paths deserve a separate test

An HTTP message signature protects the components selected by the signer. It does not encrypt the request, authorize the data use, or prove that every intermediary behaved correctly.

With an HTTPS destination reached through a conventional CONNECT tunnel, the origin request is normally carried inside end-to-end TLS after the tunnel is established. The proxy authenticates and routes the tunnel, while the origin request signature is evaluated by the destination.

Other architectures can terminate, reconstruct, or transform HTTP. An explicit HTTP proxy, reverse proxy, service gateway, redirect handler, or application middleware may change the authority, request target, path normalization, query ordering, or a selected header. A legitimate transformation can still invalidate a signature if the verifier receives different signed material.

Do not begin by assuming the proxy “breaks signatures.” Capture the request at controlled boundaries and identify the first component that differs.

Build a six-path compatibility matrix

Test the smallest matrix that represents production:

Use only test endpoints you control or are authorized to exercise. A signature validation endpoint should return a bounded result such as valid, invalid, missing component, unknown key identifier, or unsupported algorithm. Do not return secret material.

Run a safe command-line experiment

Generate a non-production test key and keep it outside shell history, logs, and shared artifacts. Then send a signed request to a controlled verifier:

curl --httpsig-algo ed25519 \
  --httpsig-key @test-key.hex \
  --httpsig-keyid test-key-01 \
  --httpsig-headers "method authority path query content-type:" \
  -H "Content-Type: application/json" \
  --data '{"probe":"proxy-path"}' \
  "$AUTHORIZED_VERIFIER_URL"

Set the environment variable only to a verifier you are authorized to use. Never place a production key directly in a command that may be stored in history.

Repeat the same logical request through each approved proxy configuration. Record curl version, proxy type, address family, requested region, redirect policy, selected components, verifier result, and a hash of the body. Redact proxy credentials, cookies, signature values, and key material.

Test component boundaries one at a time

When validation fails, compare these boundaries:

Authority

Confirm that the verifier’s authority matches the destination the signer intended. Test default ports, explicit ports, aliases, and gateways separately. Never “fix” a mismatch by broadly trusting any host.

Path and query

Check percent encoding, repeated query fields, empty values, parameter ordering, trailing slashes, and path normalization. A data-collection job that generates URLs in several libraries can produce semantically similar but byte-different requests.

Explicit headers

Only select headers whose value and normalization are stable across the intended route. If a proxy or gateway is expected to add a tracing header, do not sign a nonexistent client value and assume the intermediary can repair it.

Body and content digest

If the application protects a content digest, calculate and set it consistently. Confirm that compression, serialization, transfer encoding, and retry logic do not silently rebuild a different body.

Treat redirects and retries as new security events

A redirect can change authority, path, query, method, or body behavior. A retry can occur after a partial send or after credentials and timestamps have aged. Do not automatically copy a signature to a newly constructed request.

For each redirect and retry class, specify:

• whether the client is permitted to follow it;
• whether the destination remains authorized;
• which components must be regenerated;
• whether the body is replayable;
• the maximum attempts and time budget;
• which result stops the workflow.

Pair signature testing with the proxy retry budget guide so an invalid-signature response cannot trigger uncontrolled route rotation.

Keep keys and telemetry separate

Signature observability should help diagnose components without exposing secrets. Log the curl build, algorithm name, key identifier, selected component names, verifier result, request correlation ID, route class, and redacted error reason. Do not log private keys, shared HMAC secrets, complete signature headers, live proxy credentials, or sensitive bodies.

Use a dedicated test key with limited scope and a documented retirement date. Separate keys by environment and owner. If an HMAC secret is shared with a verifier, treat both endpoints as holders of the same secret; Ed25519 lets the verifier use a public key instead.

Upgrade checklist for proxy teams

1. Confirm the runtime is curl or libcurl 8.22.0 or later.
2. Record that HTTP Message Signatures are experimental.
3. Build a controlled verifier and non-production key.
4. Define the exact components that need protection.
5. Set important headers explicitly before selecting them.
6. Establish a direct HTTPS baseline.
7. Test CONNECT, explicit proxy, redirect, retry, IPv4, IPv6, and regional routes as applicable.
8. Compare authority, path, query, headers, body digest, and verifier result.
9. Bound retries and forbid automatic rotation on deterministic signature failures.
10. Redact keys, signatures, credentials, cookies, and sensitive bodies.
11. Stage the feature behind a limited canary.
12. Recheck curl documentation before any production decision.

For general rollout discipline, use the proxy trial acceptance test and the proxy path fallback detection guide.

FAQ

Does an HTTP message signature encrypt a request?

No. It lets a verifier check selected message components. Use TLS for confidentiality and server authentication, and apply authorization separately.

Will a CONNECT proxy always invalidate the signature?

No. With a typical HTTPS CONNECT tunnel, the origin HTTP request travels inside TLS. Test the actual implementation because gateways, redirects, and middleware can create different behavior.

Why did a header appear on the wire but remain unsigned?

curl’s experimental command-line feature signs explicitly selected headers that were also explicitly provided. Automatically generated headers are not necessarily part of the signature input.

Should production systems enable the feature immediately?

No. curl documents the options as experimental and warns against production use. Evaluate them in an isolated environment and monitor later release notes.

Compliance note

Use signed requests and proxies only with systems, accounts, data, and regions you are authorized to access. Signatures prove selected request properties; they do not grant permission, bypass rate limits, or justify evading access controls. Protect keys and personal data, respect destination terms and provider policies, and stop on authorization or policy failures.

Source note: curl project, “Changes in 8.22.0,” and curl command-line manual, published for version 8.22.0 on September 2, 2026. Source addresses are retained only in the internal operations record under 98IP’s zero-external-link policy.