hunt-request-signature

Capture a baseline of a normal signed request, then change exactly one field the signature should cover and resend through a dedicated test client. The signature is enforced only if server audit logs confirm rejection of the mismatched request.

Replay an expired, self-owned no-op request and check whether the server rejects it based on timestamp or nonce validation. A single controlled replay with fresh baselines is sufficient; bulk replays are out of scope.

A 200 response can come from caching, SDK behavior, or client-side differences rather than server acceptance. Only server audit records combined with authoritative state changes prove the server accepted a request it should have rejected.

Canonicalization is the deterministic formatting of method, path, query, body, and headers before HMAC computation. Testing confirms the server applies the same canonical rules as the client, since mismatches can let altered requests pass verification.

Stop immediately if testing would involve real signing keys, production or third-party credentials, actual transactions or resource writes, bulk replays, or bypassing request quotas. These conditions fall outside authorized, reversible validation.

JWT-specific validation routes to a dedicated JWT cryptography skill, and webhook sender or receiver verification routes to a webhook signature skill. This Skill covers general HMAC and canonical request signature boundaries only.