Visual RFC.
ALL RFCs / RFC 9530
Read the RFC ↗

RFC 9530 / START HERE

HTTP digest fields, before the details

Digest Fields is a publication title, not an acronym. A digest is a hash value calculated from bytes; HTTP means Hypertext Transfer Protocol.

Content-Digest describes message content, while Repr-Digest describes the entire selected representation data. A receiver can recalculate a digest and compare it with the conveyed value.

Start the guide See the 6 chapters ↓

The idea in one picture

  1. Choose exact bytes

  2. Calculate digest

  3. Compare with care

A simplified picture of the idea; the chapters explain the actual mechanisms.

Why it exists

A response can contain all, part or none of a representation. Explicit input scopes prevent confusing a range’s bytes with the whole resource. The new fields replace the ambiguous legacy Digest and Want-Digest fields.

A familiar example

A download returns nine bytes of a selected 19-byte JSON representation. Its content digest covers those nine bytes; its representation digest covers all 19 bytes. A matching digest does not identify the sender: an attacker may replace both the data and digest.

Helpful background

You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.

HTTPRFC 9110 · beginner overview ↗Base encodingsRFC 4648 · beginner overview ↗HMAC message tagsRFC 2104 · beginner overview ↗

What you’ll learn next

Begin with chapter one, or choose a topic.

  1. Compute a content digestA digest is a hash value calculated from bytes. Content-Digest describes the actual content of this HTTP message, not its header fields.
  2. Choose the right inputContent-Digest covers message content. Repr-Digest covers the entire selected representation data, even when this message carries none or only a range.
  3. Separate coding from framingContent coding changes representation bytes. Transfer framing carries those bytes but is not part of the digest input.
  4. Follow representation semanticsPATCH is an HTTP method that applies a patch document. For state-changing methods, identify what the enclosed representation describes.
  5. Read algorithm preferencesWant-Content-Digest and Want-Repr-Digest express interest and weighted algorithm preferences. They can appear in requests or responses.
  6. Separate integrity from trustA matching digest checks a relationship between bytes and a conveyed value. It does not by itself authenticate a sender or protect HTTP metadata.
Start with chapter one →

This introduction explains RFC 9530 (2024). Read the original RFC ↗