Skip to content

Clarify verifier outcomes for newly encountered agents #147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thibmeu merged 1 commit into from
Oct 21, 2026
Merged

Clarify verifier outcomes for newly encountered agents #147

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion draft-ietf-webbotauth-httpsig-protocol.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1059,7 +1059,12 @@ Verifiers should keep three outcomes distinct:

`unverified`
: the verifier cannot obtain enough information to decide, for example because
directory discovery failed or the key is unknown.
directory discovery failed or the resolved directory does not provide the key.

Whether the verifier has seen the Signature-Agent URL before does not change the
outcome. A request that passes verification with a key that a resolved URL provides
is verified, even when the verifier has no prior record of that URL. Whether the
URL appears on a list the origin maintains is a separate input to origin policy.

Origins can apply local policy to each outcome. During deployment, treating
`unverified` as one bot-management signal is safer than treating it as either
Expand Down
Loading