2.1.4. Trailer Fields

2.1.4. Trailer Fields

If the signer wants to include a trailer field in the signature, the signer MUST include the tr Boolean parameter to indicate that the value MUST be taken from the trailer fields and not from the header fields.

For example, given the following message:

HTTP/1.1 200 OK Content-Type: text/plain Transfer-Encoding: chunked Trailer: Expires

4 HTTP 7 Message a Signatures 0 Expires: Wed, 9 Nov 2022 07:28:00 GMT

The signer decides to add both the Trailer header field and the Expires trailer field to the signature base, along with the status code derived component:

"@status": 200 "trailer": Expires "expires";tr: Wed, 9 Nov 2022 07:28:00 GMT

If a field is available as both a header and a trailer in a message, both values MAY be signed, but the values MUST be signed separately. The values of header fields and trailer fields of the same name MUST NOT be combined for purposes of the signature.

Since trailer fields could be merged into the header fields or dropped entirely by intermediaries as per Section 6.5.1 of [HTTP], it is NOT RECOMMENDED to include trailers in the signature unless the signer knows that the verifier will have access to the values of the trailers as sent.