diff --git a/core/signatures.py b/core/signatures.py index 9434588..e78a3cb 100644 --- a/core/signatures.py +++ b/core/signatures.py @@ -160,7 +160,12 @@ class HttpSignature: raise VerificationFormatError("No signature header present") signature_details = cls.parse_signature(request.headers["signature"]) # Reject unknown algorithms - if signature_details["algorithm"] != "rsa-sha256": + # hs2019 is used by some libraries to obfuscate the real algorithm per the spec + # https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12 + if ( + signature_details["algorithm"] != "rsa-sha256" + and signature_details["algorithm"] != "hs2019" + ): raise VerificationFormatError("Unknown signature algorithm") # Create the signature payload headers_string = cls.headers_from_request(request, signature_details["headers"])