Standards & ProtocolsCrawlers & Content ControlsAgentic Web Web Bot Auth (spec repo) ·

Web Bot Auth Fixes Signature Verification Bypass Allowing Request Replay

Open source ↗

Development

A vulnerability in the Web Bot Auth implementation allowed signatures with empty component lists to pass verification without binding to a request target. Pull request #114 resolves security advisory GHSA-x9cc-346q-g27m by requiring signature coverage of @authority or @target-uri and signature-agent headers. The fix ensures verification binds signatures to specific HTTP request targets, matching the behavior of the Rust reference implementation.

Why it matters

Emerging bot authentication standards depend entirely on request-bound cryptographic proof, making component verification enforcement essential to preventing unauthorized automated traffic spoofing.

Trend impact

  • bot-authentication
  • http-signatures
  • crawler-security

Evidence