"Web Bot Auth" implementation guide is incorrect

[sandormajor]

Existing documentation URL(s)

• https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/

What changes are you suggesting?

https://github.com/cloudflare/cloudflare-docs/blob/production/src/content/docs/bots/reference/bot-verification/web-bot-auth.mdx

The page describes an outdated version of the specification. The new version contains a breaking change (thibmeu/http-message-signatures-directory#70) that needs to be reflected in the implementation guide.

This guide is also linked from other websites (example) so it might be implemented incorrectly by others.

The main difference is that the Signature-Agent header changed from a string ("https://signature-agent.test" in the example) to a dictionary (sig2="https://signature-agent.test", based on the example)

Additional information

No response

[sandormajor]

cc @thibmeu

[zetalucu256-jpg]

em

[github-actions]

Hey there, we've marked this issue as stale because there's no recent activity on it. This label helps us identify long-standing issues in our repo (and not used to auto-close issues).

[thibmeu]

indeed, cloudflare production implements draft-meunier-http-message-signatures-directory-03, which is not the latest version.

The structured field dictionary change you mention is the main discrepancy.

I've openned #31306 to adress it