From d4ac68e146efcd0aa0ffef483c57d923905c5aa8 Mon Sep 17 00:00:00 2001
From: Tomas Langer <tomas.langer@gmail.com>
Date: Fri, 26 Mar 2021 11:18:27 +0100
Subject: [PATCH] HTTP Signature fix to work according to specification.
 (#2884)

---
 security/providers/http-sign/pom.xml          |   7 +-
 .../providers/httpsign/HttpSignHeader.java    |   8 +-
 .../providers/httpsign/HttpSignProvider.java  |  36 ++-
 .../providers/httpsign/HttpSignature.java     |  67 +++--
 .../httpsign/OutboundTargetDefinition.java    |  69 ++++-
 .../http-sign/src/main/java/module-info.java  |   6 +-
 .../httpsign/HttpSignProviderTest.java        |   4 +-
 .../providers/httpsign/HttpSignatureTest.java |  75 ++---
 .../httpsign/HttpSignatureTestOld.java        | 276 ++++++++++++++++++
 9 files changed, 473 insertions(+), 75 deletions(-)
 create mode 100644 security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTestOld.java

diff --git a/security/providers/http-sign/pom.xml b/security/providers/http-sign/pom.xml
index 21f414f532b..a4dcdf6c535 100644
--- a/security/providers/http-sign/pom.xml
+++ b/security/providers/http-sign/pom.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-    Copyright (c) 2017, 2021 Oracle and/or its affiliates. All rights reserved.
+    Copyright (c) 2017, 2021 Oracle and/or its affiliates.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
@@ -42,6 +42,11 @@
             <groupId>io.helidon.common</groupId>
             <artifactId>helidon-common-key-util</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.helidon.security</groupId>
+            <artifactId>helidon-security-util</artifactId>
+        </dependency>
+
         <dependency>
             <groupId>io.helidon.security.integration</groupId>
             <artifactId>helidon-security-integration-jersey</artifactId>
diff --git a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignHeader.java b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignHeader.java
index 59e6f4da60f..78827fec21c 100644
--- a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignHeader.java
+++ b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignHeader.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,5 +28,9 @@ public enum HttpSignHeader {
      * Creates (or validates) an "Authorization" header, that contains "Signature" as the
      * beginning of its content (the rest of the header is the same as for {@link #SIGNATURE}.
      */
-    AUTHORIZATION
+    AUTHORIZATION,
+    /**
+     * Custom provided using a {@link io.helidon.security.util.TokenHandler}.
+     */
+    CUSTOM
 }
diff --git a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignProvider.java b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignProvider.java
index ecd83b0c554..7a8194c2b68 100644
--- a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignProvider.java
+++ b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignProvider.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020 Oracle and/or its affiliates.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -77,6 +77,7 @@ public final class HttpSignProvider implements AuthenticationProvider, OutboundS
     private final OutboundConfig outboundConfig;
     // cache of target name to a signature configuration for outbound calls
     private final Map<String, OutboundTargetDefinition> targetKeys = new HashMap<>();
+    private final boolean backwardCompatibleEol;
 
     private HttpSignProvider(Builder builder) {
         this.optional = builder.optional;
@@ -88,6 +89,7 @@ private HttpSignProvider(Builder builder) {
         this.inboundRequiredHeaders = builder.inboundRequiredHeaders;
         this.inboundKeys = builder.inboundKeys;
         this.outboundConfig = builder.outboundConfig;
+        this.backwardCompatibleEol = builder.backwardCompatibleEol;
 
         outboundConfig.targets().forEach(target -> target.getConfig().ifPresent(targetConfig -> {
             OutboundTargetDefinition outboundTargetDefinition = targetConfig.get("signature")
@@ -193,7 +195,7 @@ private AuthenticationResponse signatureHeader(List<String> signatures,
         String lastError = signatures.isEmpty() ? "No signature values for Signature header" : null;
 
         for (String signature : signatures) {
-            HttpSignature httpSignature = HttpSignature.fromHeader(signature);
+            HttpSignature httpSignature = HttpSignature.fromHeader(signature, backwardCompatibleEol);
             Optional<String> validate = httpSignature.validate();
             if (validate.isPresent()) {
                 lastError = validate.get();
@@ -272,7 +274,10 @@ private OutboundSecurityResponse signRequest(SecurityEnvironment outboundEnv) {
 
             Map<String, List<String>> newHeaders = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
             newHeaders.putAll(outboundEnv.headers());
-            HttpSignature signature = HttpSignature.sign(outboundEnv, targetConfig, newHeaders);
+            HttpSignature signature = HttpSignature.sign(outboundEnv,
+                                                         targetConfig,
+                                                         newHeaders,
+                                                         targetConfig.backwardCompatibleEol());
 
             OutboundSecurityResponse.Builder builder = OutboundSecurityResponse.builder()
                     .requestHeaders(newHeaders)
@@ -285,6 +290,12 @@ private OutboundSecurityResponse signRequest(SecurityEnvironment outboundEnv) {
             case AUTHORIZATION:
                 builder.requestHeader("Authorization", "Signature " + signature.toSignatureHeader());
                 break;
+            case CUSTOM:
+                Map<String, List<String>> headers = new HashMap<>();
+                targetConfig.tokenHandler()
+                        .addHeader(headers, signature.toSignatureHeader());
+                headers.forEach(builder::requestHeader);
+                break;
             default:
                 throw new HttpSignatureException("Invalid header configuration: " + targetConfig.header());
             }
@@ -312,6 +323,10 @@ public static final class Builder implements io.helidon.common.Builder<HttpSignP
         private SignedHeadersConfig inboundRequiredHeaders = SignedHeadersConfig.builder().build();
         private OutboundConfig outboundConfig = OutboundConfig.builder().build();
         private final Map<String, InboundClientDefinition> inboundKeys = new HashMap<>();
+        // not to self - we need to switch default to false in 3.0.0
+        // and probably remove this in 4.0.0
+        @Deprecated
+        private boolean backwardCompatibleEol = true;
 
         private Builder() {
         }
@@ -338,6 +353,8 @@ public Builder config(Config config) {
                     .asList(InboundClientDefinition::create)
                     .ifPresent(list -> list.forEach(inbound -> inboundKeys.put(inbound.keyId(), inbound)));
 
+            config.get("backward-compatible-eol").asBoolean().ifPresent(this::backwardCompatibleEol);
+
             return this;
         }
 
@@ -466,5 +483,18 @@ public Builder realm(String realm) {
             this.realm = realm;
             return this;
         }
+
+        /**
+         * Until version 3.0.0 (exclusive) there is a trailing end of line added to the signed
+         * data.
+         * To be able to communicate cross versions, we must configure this for newer versions
+         *
+         * @param backwardCompatible whether to run in backward compatible mode
+         * @return updated builder instance
+         */
+        public Builder backwardCompatibleEol(Boolean backwardCompatible) {
+            this.backwardCompatibleEol = backwardCompatible;
+            return this;
+        }
     }
 }
diff --git a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignature.java b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignature.java
index 95f7a223f6a..d1472561b00 100644
--- a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignature.java
+++ b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/HttpSignature.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collections;
+import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -53,27 +54,33 @@ class HttpSignature {
     private final String keyId;
     private final String algorithm;
     private final List<String> headers;
+    // Backward compatibility with Helidon versions until 3.0.0
+    // the signed string contained a trailing new line
+    private final boolean backwardCompatibleEol;
     private String base64Signature;
 
     private byte[] signatureBytes;
 
-    HttpSignature(String keyId, String algorithm, List<String> headers) {
+    HttpSignature(String keyId, String algorithm, List<String> headers, boolean backwardCompatibleEol) {
         this.keyId = keyId;
         this.algorithm = algorithm;
         this.headers = headers;
+        this.backwardCompatibleEol = backwardCompatibleEol;
     }
 
-    private HttpSignature(String header, String keyId,
+    private HttpSignature(String keyId,
                           String algorithm,
                           List<String> headers,
-                          String base64Signature) {
+                          String base64Signature,
+                          boolean backwardCompatibleEol) {
         this.keyId = keyId;
         this.algorithm = algorithm;
         this.headers = headers;
         this.base64Signature = base64Signature;
+        this.backwardCompatibleEol = backwardCompatibleEol;
     }
 
-    static HttpSignature fromHeader(String header) {
+    static HttpSignature fromHeader(String header, boolean backwardCompatibleEol) {
         /*keyId="rsa-key-1",algorithm="rsa-sha256",
                 headers="(request-target) host date digest content-length",
                 signature="Base64(RSA-SHA256(signing string))"*/
@@ -92,18 +99,18 @@ static HttpSignature fromHeader(String header) {
             int c = header.indexOf(',', b);
             int eq = header.indexOf('=', b);
             if (eq == -1) {
-                return new HttpSignature(header, keyId, algorithm, headers, signature);
+                return new HttpSignature(keyId, algorithm, headers, signature, backwardCompatibleEol);
             }
             if (eq > c) {
                 b = c + 1;
             }
             int qb = header.indexOf('"', eq);
             if (qb == -1) {
-                return new HttpSignature(header, keyId, algorithm, headers, signature);
+                return new HttpSignature(keyId, algorithm, headers, signature, backwardCompatibleEol);
             }
             int qe = header.indexOf('"', qb + 1);
             if (qe == -1) {
-                return new HttpSignature(header, keyId, algorithm, headers, signature);
+                return new HttpSignature(keyId, algorithm, headers, signature, backwardCompatibleEol);
             }
 
             String name = header.substring(b, eq).trim();
@@ -128,19 +135,21 @@ static HttpSignature fromHeader(String header) {
             }
             b = qe + 1;
             if (b >= header.length()) {
-                return new HttpSignature(header, keyId, algorithm, headers, signature);
+                return new HttpSignature(keyId, algorithm, headers, signature, backwardCompatibleEol);
             }
         }
     }
 
     static HttpSignature sign(SecurityEnvironment env,
                               OutboundTargetDefinition outboundDefinition,
-                              Map<String, List<String>> newHeaders) {
+                              Map<String, List<String>> newHeaders,
+                              boolean backwardCompatibleEol) {
 
         HttpSignature signature = new HttpSignature(outboundDefinition.keyId(),
                                                     outboundDefinition.algorithm(),
                                                     outboundDefinition.signedHeadersConfig()
-                                                            .headers(env.method(), env.headers()));
+                                                            .headers(env.method(), env.headers()),
+                                                    backwardCompatibleEol);
 
         // validate algorithm is OK
         //let's try to validate the signature
@@ -259,9 +268,9 @@ private byte[] signRsaSha256(SecurityEnvironment env, KeyConfig keyConfig, Map<S
         try {
             Signature signature = Signature.getInstance("SHA256withRSA");
             signature.initSign(keyConfig.privateKey().orElseThrow(() ->
-                                                                             new HttpSignatureException(
-                                                                                     "Private key is required, yet not "
-                                                                                             + "configured")));
+                                                                          new HttpSignatureException(
+                                                                                  "Private key is required, yet not "
+                                                                                          + "configured")));
             signature.update(getBytesToSign(env, newHeaders));
             return signature.sign();
         } catch (NoSuchAlgorithmException | InvalidKeyException | SignatureException e) {
@@ -331,18 +340,15 @@ private byte[] getBytesToSign(SecurityEnvironment env, Map<String, List<String>>
     }
 
     String getSignedString(Map<String, List<String>> newHeaders, SecurityEnvironment env) {
-        StringBuilder toSign = new StringBuilder();
         Map<String, List<String>> requestHeaders = env.headers();
+        List<String> linesToSign = new LinkedList<>();
 
         for (String header : this.headers) {
             if ("(request-target)".equals(header)) {
                 //special case
-                toSign.append(header)
-                        .append(": ")
-                        .append(env.method().toLowerCase())
-                        .append(" ")
-                        .append(env.path().orElse("/"))
-                        .append('\n');
+                linesToSign.add(header
+                                        + ": " + env.method().toLowerCase()
+                                        + " " + env.path().orElse("/"));
             } else {
                 List<String> headerValues = requestHeaders.get(header);
                 if (null == headerValues && null == newHeaders) {
@@ -372,15 +378,22 @@ String getSignedString(Map<String, List<String>> newHeaders, SecurityEnvironment
                     }
                 }
 
-                toSign.append(header)
-                        .append(": ")
-                        .append(String.join(" ", headerValues))
-                        .append('\n');
+                linesToSign.add(header + ": " + String.join(" ", headerValues));
             }
         }
 
-        LOGGER.finest(() -> "Data to sign: " + toSign);
+        // 2.3.  Signature String Construction
+        // If value is not the last value then append an ASCII newline `\n`.
+        String toSign = String.join("\n", linesToSign);
 
-        return toSign.toString();
+        if (backwardCompatibleEol) {
+            toSign = toSign + "\n";
+        }
+
+        if (LOGGER.isLoggable(Level.FINEST)) {
+            LOGGER.finest("Data to sign: " + toSign);
+        }
+
+        return toSign;
     }
 }
diff --git a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/OutboundTargetDefinition.java b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/OutboundTargetDefinition.java
index e11ba29a94a..a171e734a27 100644
--- a/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/OutboundTargetDefinition.java
+++ b/security/providers/http-sign/src/main/java/io/helidon/security/providers/httpsign/OutboundTargetDefinition.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2020 Oracle and/or its affiliates.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,9 +20,11 @@
 import java.util.Arrays;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.logging.Logger;
 
 import io.helidon.common.pki.KeyConfig;
 import io.helidon.config.Config;
+import io.helidon.security.util.TokenHandler;
 
 /**
  * Configuration of outbound target to sign outgoing requests.
@@ -34,6 +36,8 @@ public final class OutboundTargetDefinition {
     private final HttpSignHeader header;
     private final byte[] hmacSharedSecret;
     private final SignedHeadersConfig signedHeadersConfig;
+    private final TokenHandler tokenHandler;
+    private final boolean backwardCompatibleEol;
 
     private OutboundTargetDefinition(Builder builder) {
         this.keyId = builder.keyId;
@@ -42,6 +46,8 @@ private OutboundTargetDefinition(Builder builder) {
         this.header = builder.header;
         this.hmacSharedSecret = builder.hmacSharedSecret;
         this.signedHeadersConfig = builder.signedHeadersConfig;
+        this.tokenHandler = builder.tokenHandler;
+        this.backwardCompatibleEol = builder.backwardCompatibleEol;
 
         Objects.requireNonNull(algorithm, "Signature algorithm must not be null");
         Objects.requireNonNull(keyId, "Key id must not be null");
@@ -147,17 +153,45 @@ public SignedHeadersConfig signedHeadersConfig() {
         return signedHeadersConfig;
     }
 
+    /**
+     * When header type is set to {@link io.helidon.security.providers.httpsign.HttpSignHeader#CUSTOM},
+     *  this handler will be used to create header in outbound request.
+     *
+     * @return token handler
+     */
+    public TokenHandler tokenHandler() {
+        return tokenHandler;
+    }
+
+    /**
+     * Whether to use old approach to EOL processing in signed data.
+     * The old approach (pre Helidon 3.0.0) was adding a trailing end of line, which is
+     * not aligned with the specification proposal.
+     *
+     * @return whether to use old approach (trailing EOL - {@code true}), or correct approach ({@code false}ú
+     */
+    public boolean backwardCompatibleEol() {
+        return backwardCompatibleEol;
+    }
+
     /**
      * Fluent API builder to build {@link OutboundTargetDefinition} instances.
      * Call {@link #build()} to create a new instance.
      */
     public static final class Builder implements io.helidon.common.Builder<OutboundTargetDefinition> {
+        private static final Logger LOGGER = Logger.getLogger(Builder.class.getName());
+
         private String keyId;
         private String algorithm;
         private KeyConfig keyConfig;
         private HttpSignHeader header = HttpSignHeader.SIGNATURE;
         private byte[] hmacSharedSecret;
         private SignedHeadersConfig signedHeadersConfig = HttpSignProvider.DEFAULT_REQUIRED_HEADERS;
+        private TokenHandler tokenHandler;
+        // this is internal deprecation to make sure we switch this flag default to false for 3.0.0
+        // to be removed in 4.0.0 (most likely)
+        @Deprecated
+        private boolean backwardCompatibleEol = true;
 
         private Builder() {
         }
@@ -255,8 +289,25 @@ public Builder hmacSecret(String secret) {
             return hmacSecret(secret.getBytes(StandardCharsets.UTF_8));
         }
 
+        /**
+         * Configure a token handler to create the outbound header.
+         *
+         * @param tokenHandler token handler to use
+         * @return updated builder instance
+         */
+        public Builder tokenHandler(TokenHandler tokenHandler) {
+            this.tokenHandler = tokenHandler;
+            this.header = HttpSignHeader.CUSTOM;
+            return this;
+        }
+
         @Override
         public OutboundTargetDefinition build() {
+            if (backwardCompatibleEol) {
+                LOGGER.warning("HTTP signatures is using legacy HTTP signature processing. This will not work"
+                                       + " with third party tools using the same spec and with Helidon newer than 3.0.0."
+                                       + " Please configure 'backward-compatible-eol' to false to use the correct approach.");
+            }
             return new OutboundTargetDefinition(this);
         }
 
@@ -279,7 +330,23 @@ public Builder config(Config config) {
             // last, as we configure defaults based on configuration
             config.get("algorithm").asString().ifPresent(builder::algorithm);
 
+            // backward compatibility with previous Helidon versions
+            config.get("backward-compatible-eol").asBoolean().ifPresent(this::backwardCompatibleEol);
+
             return builder;
         }
+
+        /**
+         * Until version 3.0.0 (exclusive) there is a trailing end of line added to the signed
+         * data.
+         * When configured to {@code false}, the correct approach is used.
+         *
+         * @param backwardCompatible whether to run in backward compatible mode
+         * @return updated builder instance
+         */
+        public Builder backwardCompatibleEol(Boolean backwardCompatible) {
+            this.backwardCompatibleEol = backwardCompatible;
+            return this;
+        }
     }
 }
diff --git a/security/providers/http-sign/src/main/java/module-info.java b/security/providers/http-sign/src/main/java/module-info.java
index 2cc91482eb7..1d3cc3084cc 100644
--- a/security/providers/http-sign/src/main/java/module-info.java
+++ b/security/providers/http-sign/src/main/java/module-info.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,12 +18,14 @@
  * Http signature provider.
  */
 module io.helidon.security.providers.httpsign {
+    requires java.logging;
+
     requires transitive io.helidon.config;
     requires transitive io.helidon.common;
     requires transitive io.helidon.security;
     requires transitive io.helidon.common.pki;
+    requires transitive io.helidon.security.util;
     requires transitive io.helidon.security.providers.common;
-    requires java.logging;
 
     exports io.helidon.security.providers.httpsign;
 
diff --git a/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignProviderTest.java b/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignProviderTest.java
index d6980b49a59..d4674a25e33 100644
--- a/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignProviderTest.java
+++ b/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignProviderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -235,7 +235,7 @@ private void validateSignatureHeader(
             String algorithm,
             List<String> headers,
             String actualSignature) {
-        HttpSignature httpSignature = HttpSignature.fromHeader(signatureHeader);
+        HttpSignature httpSignature = HttpSignature.fromHeader(signatureHeader, true);
 
         String reason = httpSignature.getAlgorithm() + ", " + httpSignature.getHeaders() + ", " + httpSignature
                 .getSignedString(new HashMap<>(), env);
diff --git a/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTest.java b/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTest.java
index 579a2e4327f..d16c01da72c 100644
--- a/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTest.java
+++ b/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2019 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -102,22 +102,22 @@ public void testInvalid1() {
                 + "headers=(request-target) host date digest content-length\","
                 + "signature=\"Base64(RSA-SHA256(signing string))\",algorithm=\"rsa-sha256\",abcd=\"asf";
 
-        HttpSignature httpSignature = HttpSignature.fromHeader(invalidSignature);
+        HttpSignature httpSignature = HttpSignature.fromHeader(invalidSignature, false);
         Optional<String> validate = httpSignature.validate();
 
         validate.ifPresentOrElse(msg -> assertThat(msg, containsString("signature is a mandatory")),
-                                                      () -> fail("Should have failed validation"));
+                                 () -> fail("Should have failed validation"));
     }
 
     @Test
     public void testInvalid2() {
         String invalidSignature = "This is a wrong signature";
 
-        HttpSignature httpSignature = HttpSignature.fromHeader(invalidSignature);
+        HttpSignature httpSignature = HttpSignature.fromHeader(invalidSignature, false);
         Optional<String> validate = httpSignature.validate();
 
         validate.ifPresentOrElse(msg -> assertThat(msg, containsString("keyId is a mandatory")),
-                                                      () -> fail("Should have failed validation"));
+                                 () -> fail("Should have failed validation"));
     }
 
     @Test
@@ -138,19 +138,18 @@ public void testSignRsa() {
                                        .defaultConfig(SignedHeadersConfig
                                                               .HeadersConfig
                                                               .create(List.of("date",
-                                                                                               "host",
-                                                                                               "(request-target)",
-                                                                                               "authorization")))
+                                                                              "host",
+                                                                              "(request-target)",
+                                                                              "authorization")))
                                        .build())
                 .build();
 
-        HttpSignature signature = HttpSignature.sign(env, outboundDef, new HashMap<>());
+        HttpSignature signature = HttpSignature.sign(env, outboundDef, new HashMap<>(), false);
         assertThat(signature.getBase64Signature(),
-                   is("Rm5PjuUdJ927esGQ2gm/6QBEM9IM7J5qSZuP8NV8+GXUfboUV6ST2EYLYniFGt5/3BO/2+vqQdqezdTVPr/JCwqBx"
-                              + "+9T9ZynG7YqRjKvXzcmvQOu5vQmCK5x/HR0fXU41Pjq+jywsD0k6KdxF6TWr6tvWRbwFet+YSb0088o"
-                              + "/65Xeqghw7s0vShf7jPZsaaIHnvM9SjWgix9VvpdEn4NDvqhebieVD3Swb1VG5+/7ECQ9VAlX30U5"
-                              + "/jQ5hPO3yuvRlg5kkMjJiN7tf/68If/5O2Z4H+7VmW0b1U69/JoOQJA0av1gCX7HVfa"
-                              + "/YTCxIK4UFiI6h963q2x7LSkqhdWGA=="));
+                   is("ptxE46kM/gV8L6Q0jcrY5Sxet7vy/rqldwxJfWT5ncbALbwvr4puc3/M0q8pT/srI/bLvtPPZxQN9flaWyHo2ieypRSRZe5/2FrcME"
+                              + "+XuGNOu9BVJlCrALgLwi2VGJ3i2BIH2EvpLqF4TmM7AHIn/E6trWf30Kr90sTrk1ewx7kJ0bPVfY6Pv1mJpuA4MVr"
+                              + "++BvvXMuGooMI+nepToPlseGgtnYMJPuTRwZJbTLo02yN1rKnRZauCxCCd0bgi9zhJRlXFuoLzthCgqHElCXVXrW"
+                              + "+ZGACUaRDC+XawXg6eyMWp6GVegS/NVRnaqEkBsl0hn7X/dmEXDDERyK66qn0WA=="));
     }
 
     @Test
@@ -167,15 +166,15 @@ public void testSignHmac() {
                                        .defaultConfig(SignedHeadersConfig
                                                               .HeadersConfig
                                                               .create(List.of("date",
-                                                                                               "host",
-                                                                                               "(request-target)",
-                                                                                               "authorization")))
+                                                                              "host",
+                                                                              "(request-target)",
+                                                                              "authorization")))
                                        .build())
                 .build();
 
-        HttpSignature signature = HttpSignature.sign(env, outboundDef, new HashMap<>());
+        HttpSignature signature = HttpSignature.sign(env, outboundDef, new HashMap<>(), false);
 
-        assertThat(signature.getBase64Signature(), is("0BcQq9TckrtGvlpHiMxNqMq0vW6dPVTGVDUVDrGwZyI="));
+        assertThat(signature.getBase64Signature(), is("yaxxY9oY0+qKhAr9sYCfmYQyKjRVctN6z1c9ANhbZ/c="));
     }
 
     @Test
@@ -190,32 +189,27 @@ public void testSignHmacAddHeaders() {
                                        .defaultConfig(SignedHeadersConfig
                                                               .HeadersConfig
                                                               .create(List.of("date",
-                                                                                               "host")))
+                                                                              "host")))
                                        .build())
                 .build();
 
         // just make sure this does not throw an exception for missing headers
-        HttpSignature.sign(env, outboundDef, new HashMap<>());
-    }
-
-    private SecurityEnvironment buildSecurityEnv(String path, Map<String, List<String>> headers) {
-        return SecurityEnvironment.builder()
-                .path(path)
-                .headers(headers)
-                .build();
+        HttpSignature.sign(env, outboundDef, new HashMap<>(), false);
     }
 
     @Test
     public void testVerifyRsa() {
         HttpSignature signature = HttpSignature.fromHeader("keyId=\"rsa-key-12345\",algorithm=\"rsa-sha256\",headers=\"date "
                                                                    + "host (request-target) authorization\","
-                                                                   + "signature=\"Rm5PjuUdJ927esGQ2gm/6QBEM9IM7J5qSZuP8NV8+GXUf"
-                                                                   + "boUV6ST2EYLYniFGt5/3BO/2+vqQdqezdTVPr/JCwqBx+9T9ZynG7YqRj"
-                                                                   + "KvXzcmvQOu5vQmCK5x/HR0fXU41Pjq+jywsD0k6KdxF6TWr6tvWRbwFet"
-                                                                   + "+YSb0088o/65Xeqghw7s0vShf7jPZsaaIHnvM9SjWgix9VvpdEn4NDvqh"
-                                                                   + "ebieVD3Swb1VG5+/7ECQ9VAlX30U5/jQ5hPO3yuvRlg5kkMjJiN7tf/68"
-                                                                   + "If/5O2Z4H+7VmW0b1U69/JoOQJA0av1gCX7HVfa/YTCxIK4UFiI6h963q"
-                                                                   + "2x7LSkqhdWGA==\"");
+                                                                   + "signature=\"ptxE46kM/gV8L6Q0jcrY5Sxet7vy"
+                                                                   + "/rqldwxJfWT5ncbALbwvr4puc3/M0q8pT/srI"
+                                                                   + "/bLvtPPZxQN9flaWyHo2ieypRSRZe5/2FrcME"
+                                                                   + "+XuGNOu9BVJlCrALgLwi2VGJ3i2BIH2EvpLqF4TmM7AHIn"
+                                                                   + "/E6trWf30Kr90sTrk1ewx7kJ0bPVfY6Pv1mJpuA4MVr++BvvXMuGooMI"
+                                                                   + "+nepToPlseGgtnYMJPuTRwZJbTLo02yN1rKnRZauCxCCd0bgi9zhJRlX"
+                                                                   + "FuoLzthCgqHElCXVXrW+ZGACUaRDC+XawXg6eyMWp6GVegS/NVRnaqEk"
+                                                                   + "Bsl0hn7X/dmEXDDERyK66qn0WA==\"",
+                                                           false);
         signature.validate().ifPresent(Assertions::fail);
 
         Map<String, List<String>> headers = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
@@ -242,7 +236,7 @@ public void testVerifyRsa() {
     public void testVerifyHmac() {
         HttpSignature signature = HttpSignature.fromHeader(
                 "keyId=\"myServiceKeyId\",algorithm=\"hmac-sha256\",headers=\"date host (request-target) authorization\","
-                        + "signature=\"0BcQq9TckrtGvlpHiMxNqMq0vW6dPVTGVDUVDrGwZyI=\"");
+                        + "signature=\"yaxxY9oY0+qKhAr9sYCfmYQyKjRVctN6z1c9ANhbZ/c=\"", false);
 
         signature.validate().ifPresent(Assertions::fail);
 
@@ -263,8 +257,15 @@ public void testVerifyHmac() {
                 .ifPresent(Assertions::fail);
     }
 
+    private SecurityEnvironment buildSecurityEnv(String path, Map<String, List<String>> headers) {
+        return SecurityEnvironment.builder()
+                .path(path)
+                .headers(headers)
+                .build();
+    }
+
     private void testValid(String validSignature) {
-        HttpSignature httpSignature = HttpSignature.fromHeader(validSignature);
+        HttpSignature httpSignature = HttpSignature.fromHeader(validSignature, false);
 
         assertThat(httpSignature.getAlgorithm(), is("rsa-sha256"));
         assertThat(httpSignature.getKeyId(), is("rsa-key-1"));
diff --git a/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTestOld.java b/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTestOld.java
new file mode 100644
index 00000000000..1dc6dca7fc6
--- /dev/null
+++ b/security/providers/http-sign/src/test/java/io/helidon/security/providers/httpsign/HttpSignatureTestOld.java
@@ -0,0 +1,276 @@
+/*
+ * Copyright (c) 2018, 2021 Oracle and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.helidon.security.providers.httpsign;
+
+import java.net.URI;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.TreeMap;
+
+import io.helidon.common.configurable.Resource;
+import io.helidon.common.pki.KeyConfig;
+import io.helidon.security.SecurityEnvironment;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.equalTo;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.fail;
+
+/**
+ * Unit test for {@link HttpSignature}.
+ */
+public class HttpSignatureTestOld {
+    @Test
+    public void testValid() {
+        String validSignature = "keyId=\"rsa-key-1\",algorithm=\"rsa-sha256\","
+                + "headers=\"(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\"";
+
+        testValid(validSignature);
+    }
+
+    @Test
+    public void testValidInvalidComponent() {
+        String validSignature = "keyId=\"rsa-key-1\",algorithm=\"rsa-sha256\","
+                + "headers=\"(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\",hurhur=\"ignored\"";
+
+        testValid(validSignature);
+    }
+
+    @Test
+    public void testValidRepeatedComponent() {
+        String validSignature = "keyId=\"rsa-key-1\",algorithm=\"hamc-sha256\","
+                + "headers=\"(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\",algorithm=\"rsa-sha256\"";
+
+        testValid(validSignature);
+    }
+
+    @Test
+    public void testValidInvalidLastComponent1() {
+        String validSignature = "keyId=\"rsa-key-1\",algorithm=\"hamc-sha256\","
+                + "headers=\"(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\",algorithm=\"rsa-sha256\",abcd";
+
+        testValid(validSignature);
+    }
+
+    @Test
+    public void testValidInvalidLastComponent2() {
+        String validSignature = "keyId=\"rsa-key-1\",algorithm=\"hamc-sha256\","
+                + "headers=\"(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\",algorithm=\"rsa-sha256\",abcd=";
+
+        testValid(validSignature);
+    }
+
+    @Test
+    public void testValidInvalidLastComponent3() {
+        String validSignature = "keyId=\"rsa-key-1\",algorithm=\"hamc-sha256\","
+                + "headers=\"(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\",algorithm=\"rsa-sha256\",abcd=\"asf";
+
+        testValid(validSignature);
+    }
+
+    @Test
+    public void testInvalid1() {
+        String invalidSignature = "keyId=\"rsa-key-1\",algorithm=\"hamc-sha256\","
+                // missing quotes for headers
+                + "headers=(request-target) host date digest content-length\","
+                + "signature=\"Base64(RSA-SHA256(signing string))\",algorithm=\"rsa-sha256\",abcd=\"asf";
+
+        HttpSignature httpSignature = HttpSignature.fromHeader(invalidSignature, true);
+        Optional<String> validate = httpSignature.validate();
+
+        validate.ifPresentOrElse(msg -> assertThat(msg, containsString("signature is a mandatory")),
+                                                      () -> fail("Should have failed validation"));
+    }
+
+    @Test
+    public void testInvalid2() {
+        String invalidSignature = "This is a wrong signature";
+
+        HttpSignature httpSignature = HttpSignature.fromHeader(invalidSignature, true);
+        Optional<String> validate = httpSignature.validate();
+
+        validate.ifPresentOrElse(msg -> assertThat(msg, containsString("keyId is a mandatory")),
+                                                      () -> fail("Should have failed validation"));
+    }
+
+    @Test
+    public void testSignRsa() {
+        Map<String, List<String>> headers = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        headers.put("DATE", List.of("Thu, 08 Jun 2014 18:32:30 GMT"));
+        headers.put("Authorization", List.of("basic dXNlcm5hbWU6cGFzc3dvcmQ="));
+        headers.put("host", List.of("example.org"));
+
+        SecurityEnvironment env = buildSecurityEnv("/my/resource", headers);
+        OutboundTargetDefinition outboundDef = OutboundTargetDefinition.builder("rsa-key-12345")
+                .privateKeyConfig(KeyConfig.keystoreBuilder()
+                                          .keystore(Resource.create(Paths.get("src/test/resources/keystore.p12")))
+                                          .keystorePassphrase("password".toCharArray())
+                                          .keyAlias("myPrivateKey")
+                                          .build())
+                .signedHeaders(SignedHeadersConfig.builder()
+                                       .defaultConfig(SignedHeadersConfig
+                                                              .HeadersConfig
+                                                              .create(List.of("date",
+                                                                                               "host",
+                                                                                               "(request-target)",
+                                                                                               "authorization")))
+                                       .build())
+                .build();
+
+        HttpSignature signature = HttpSignature.sign(env, outboundDef, new HashMap<>(), true);
+        assertThat(signature.getBase64Signature(),
+                   is("Rm5PjuUdJ927esGQ2gm/6QBEM9IM7J5qSZuP8NV8+GXUfboUV6ST2EYLYniFGt5/3BO/2+vqQdqezdTVPr/JCwqBx"
+                              + "+9T9ZynG7YqRjKvXzcmvQOu5vQmCK5x/HR0fXU41Pjq+jywsD0k6KdxF6TWr6tvWRbwFet+YSb0088o"
+                              + "/65Xeqghw7s0vShf7jPZsaaIHnvM9SjWgix9VvpdEn4NDvqhebieVD3Swb1VG5+/7ECQ9VAlX30U5"
+                              + "/jQ5hPO3yuvRlg5kkMjJiN7tf/68If/5O2Z4H+7VmW0b1U69/JoOQJA0av1gCX7HVfa"
+                              + "/YTCxIK4UFiI6h963q2x7LSkqhdWGA=="));
+    }
+
+    @Test
+    public void testSignHmac() {
+        Map<String, List<String>> headers = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        headers.put("DATE", List.of("Thu, 08 Jun 2014 18:32:30 GMT"));
+        headers.put("Authorization", List.of("basic dXNlcm5hbWU6cGFzc3dvcmQ="));
+        headers.put("host", List.of("example.org"));
+        SecurityEnvironment env = buildSecurityEnv("/my/resource", headers);
+
+        OutboundTargetDefinition outboundDef = OutboundTargetDefinition.builder("myServiceKeyId")
+                .hmacSecret("MyPasswordForHmac")
+                .signedHeaders(SignedHeadersConfig.builder()
+                                       .defaultConfig(SignedHeadersConfig
+                                                              .HeadersConfig
+                                                              .create(List.of("date",
+                                                                                               "host",
+                                                                                               "(request-target)",
+                                                                                               "authorization")))
+                                       .build())
+                .build();
+
+        HttpSignature signature = HttpSignature.sign(env, outboundDef, new HashMap<>(), true);
+
+        assertThat(signature.getBase64Signature(), is("0BcQq9TckrtGvlpHiMxNqMq0vW6dPVTGVDUVDrGwZyI="));
+    }
+
+    @Test
+    public void testSignHmacAddHeaders() {
+        SecurityEnvironment env = SecurityEnvironment.builder()
+                .targetUri(URI.create("http://localhost/test/path"))
+                .build();
+
+        OutboundTargetDefinition outboundDef = OutboundTargetDefinition.builder("myServiceKeyId")
+                .hmacSecret("MyPasswordForHmac")
+                .signedHeaders(SignedHeadersConfig.builder()
+                                       .defaultConfig(SignedHeadersConfig
+                                                              .HeadersConfig
+                                                              .create(List.of("date",
+                                                                                               "host")))
+                                       .build())
+                .build();
+
+        // just make sure this does not throw an exception for missing headers
+        HttpSignature.sign(env, outboundDef, new HashMap<>(), true);
+    }
+
+    private SecurityEnvironment buildSecurityEnv(String path, Map<String, List<String>> headers) {
+        return SecurityEnvironment.builder()
+                .path(path)
+                .headers(headers)
+                .build();
+    }
+
+    @Test
+    public void testVerifyRsa() {
+        HttpSignature signature = HttpSignature.fromHeader("keyId=\"rsa-key-12345\",algorithm=\"rsa-sha256\",headers=\"date "
+                                                                   + "host (request-target) authorization\","
+                                                                   + "signature=\"Rm5PjuUdJ927esGQ2gm/6QBEM9IM7J5qSZuP8NV8+GXUf"
+                                                                   + "boUV6ST2EYLYniFGt5/3BO/2+vqQdqezdTVPr/JCwqBx+9T9ZynG7YqRj"
+                                                                   + "KvXzcmvQOu5vQmCK5x/HR0fXU41Pjq+jywsD0k6KdxF6TWr6tvWRbwFet"
+                                                                   + "+YSb0088o/65Xeqghw7s0vShf7jPZsaaIHnvM9SjWgix9VvpdEn4NDvqh"
+                                                                   + "ebieVD3Swb1VG5+/7ECQ9VAlX30U5/jQ5hPO3yuvRlg5kkMjJiN7tf/68"
+                                                                   + "If/5O2Z4H+7VmW0b1U69/JoOQJA0av1gCX7HVfa/YTCxIK4UFiI6h963q"
+                                                                   + "2x7LSkqhdWGA==\"", true);
+        signature.validate().ifPresent(Assertions::fail);
+
+        Map<String, List<String>> headers = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        headers.put("DATE", List.of("Thu, 08 Jun 2014 18:32:30 GMT"));
+        headers.put("Authorization", List.of("basic dXNlcm5hbWU6cGFzc3dvcmQ="));
+        headers.put("host", List.of("example.org"));
+
+        InboundClientDefinition inboundClientDef = InboundClientDefinition.builder("rsa-key-12345")
+                .principalName("theService")
+                .publicKeyConfig(KeyConfig.keystoreBuilder()
+                                         .keystore(Resource.create(Paths.get("src/test/resources/keystore.p12")))
+                                         .keystorePassphrase("password".toCharArray())
+                                         .certAlias("service_cert")
+                                         .build())
+                .build();
+
+        signature.validate(buildSecurityEnv("/my/resource", headers),
+                           inboundClientDef,
+                           List.of("date"))
+                .ifPresent(Assertions::fail);
+    }
+
+    @Test
+    public void testVerifyHmac() {
+        HttpSignature signature = HttpSignature.fromHeader(
+                "keyId=\"myServiceKeyId\",algorithm=\"hmac-sha256\",headers=\"date host (request-target) authorization\","
+                        + "signature=\"0BcQq9TckrtGvlpHiMxNqMq0vW6dPVTGVDUVDrGwZyI=\"", true);
+
+        signature.validate().ifPresent(Assertions::fail);
+
+        Map<String, List<String>> headers = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        headers.put("DATE", List.of("Thu, 08 Jun 2014 18:32:30 GMT"));
+        headers.put("Authorization", List.of("basic dXNlcm5hbWU6cGFzc3dvcmQ="));
+        headers.put("host", List.of("example.org"));
+        SecurityEnvironment env = buildSecurityEnv("/my/resource", headers);
+
+        InboundClientDefinition inboundClientDef = InboundClientDefinition.builder("myServiceKeyId")
+                .principalName("theService")
+                .hmacSecret("MyPasswordForHmac")
+                .build();
+
+        signature.validate(env,
+                           inboundClientDef,
+                           List.of("date"))
+                .ifPresent(Assertions::fail);
+    }
+
+    private void testValid(String validSignature) {
+        HttpSignature httpSignature = HttpSignature.fromHeader(validSignature, true);
+
+        assertThat(httpSignature.getAlgorithm(), is("rsa-sha256"));
+        assertThat(httpSignature.getKeyId(), is("rsa-key-1"));
+        assertThat(httpSignature.getBase64Signature(), is("Base64(RSA-SHA256(signing string))"));
+        assertThat(httpSignature.getHeaders(),
+                   equalTo(List.of("(request-target)", "host", "date", "digest", "content-length")));
+    }
+
+}