Page Comparison

The format of Date or Original-Date header included in the client's request or the server's response is invalid.

A typical problem is using wrong timezone. The specification says: "The format of the Original-Date header, if included, MUST match the "regular" format of the Date header, as defined in RFC 2616." and the RFC says: "All HTTP date/time stamps MUST be represented in Greenwich Mean Time (GMT), without exception.".

A valid value:

• Sat, 01 Jul 2023 02:06:08 GMT

Invalid values:

• Sat, 03 Jun 2023 04:08:54 CEST

• Thu, 22 Dec 2022 10:49:01 GMT+2:00

Enforceabsolutecompliance with the specification

Monitoring system

Problem occurred for at least 4 providers in the DEV network

Wrong time in Date or Original-Date headers – server clock not synchronized: "The time in Date or Original-Date header included in the client's request or the server's response doesn't match current time.

The specification says: "(...) you MUST make sure that your clock is synchronized (otherwise your clients won't be able to use your service)."

Synchronize clocks

Monitoring system

Problem occurred for at least 3 providers in DEV (link1, link2)

The value in Digest header included in the client's request or the server's response is invalid.

Possible issue might be that the digest is calculated before the content is fully encoded. The specification says: "Many frameworks or proxies might try to automatically modify your response after you sign it. For example, they may try to add additional gzip coding to your response's Content-Encodings if they detect that the client supports it. In many cases, this would be a good thing, but in this case, such changes could break your HTTP Signature (because we sign the content after it has been encoded). Make sure that you disable such automatic modifications when you use HTTP Signatures for signing."

Enforceabsolutecompliance with the specification

Monitoring system

Problem occurred for at least 2 providers in PROD and probably for 11 providers in DEV (link1, link2)

The signature included in the client's request or the server's response is invalid.

It may be a problem with proxies replacing the Date header, thus invalidating the signature. The specification says: "If your proxy is replacing the Date header, and you cannot reliably reconfigure it to not do so, then you MAY use the Original-Date header as a replacement for the Date header."

Enforceabsolutecompliance with the specification

Problem occurred for at least 5 providers in PROD (link1, link2) and for app. 3 providers in DEV (link1, link2)