feat!: Spaces — HTTP Message Signatures replace DPoP #212

New issue

Closed

opened 2026-10-05 13:05:44 +00:00 by Grandiras · 0 comments

Grandiras commented

2026-10-05 13:05:44 +00:00

Owner

Spaces alpha 2026-10-01 (#5569): credentials bound by cnf.kid to an ephemeral P-256 did:key; exchange and use signed with RFC 9421 HTTP Message Signatures (atproto-space label, Authorization: Atproto-Space, Atproto-Space-Audience); 600 s credentials (max 3600), jti/exp/iat skew enforcement; BadSpaceSignature / BadSpaceAudience. Client and server halves.

Source: protocol catch-up report of 2026-10-05 (upstream bluesky-social/atproto main since 2e583a4; Spaces alpha of 2026-10-01, reference implementation 679724ad, proposal 0c9c2e88).

Spaces alpha 2026-10-01 (#5569): credentials bound by `cnf.kid` to an ephemeral P-256 did:key; exchange and use signed with RFC 9421 HTTP Message Signatures (`atproto-space` label, `Authorization: Atproto-Space`, `Atproto-Space-Audience`); 600 s credentials (max 3600), `jti`/`exp`/`iat` skew enforcement; `BadSpaceSignature` / `BadSpaceAudience`. Client and server halves. Source: protocol catch-up report of 2026-10-05 (upstream `bluesky-social/atproto` main since `2e583a4`; Spaces alpha of 2026-10-01, reference implementation `679724ad`, proposal `0c9c2e88`).

Grandiras referenced this issue from a commit

2026-10-05 13:44:29 +00:00

feat!: Spaces requests signed with HTTP Message Signatures instead of DPoP (closes #212)

Grandiras referenced this issue

2026-10-05 13:44:31 +00:00

feat!: Spaces spaceType rename and 2026-10-01 alpha pins #217

Grandiras referenced this issue from a pull request that will close it,

2026-10-05 13:44:45 +00:00

feat!: Spaces requests signed with HTTP Message Signatures instead of DPoP #218