The core HTTP specifications don’t define their own means of providing integrity. Although “hop-by-hop” protocols underneath HTTP, such as TLS or QUIC, provide integrity for HTTP message transactions, it isn’t enough. HTTP powers massively distributed systems where intermediaries (aka proxies) are first-class citizens. Coupled with that are the powerful semantics of HTTP resources and representations.

This post explores the past, present, and future of HTTP extensions that allow for HTTP Integrity. We’ll cover core concepts, fields such as Content-MD5, Digest, Content-Digest, Repr-Digest, Unencoded-Digest, and more. However, some foundational HTTP understanding needs to be established before we can start. If you just want to jump into an interactive demo playground see my HTTP Integrity Demos page.