linzer 0.8.0.beta1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0330e72cbbfb7cc56b9fa124a4f60a18bb7fbdab4eb98a072598c8fc3680cf76
-  data.tar.gz: 321630c979fc736cc64284eb535b22752e50a42c8bbfae399cbf0db56efecdd3
+  metadata.gz: 47932906cedb5dd66d7d2bbc5e8eaac9f01b4e17dd7089bc87b4a06b9505b366
+  data.tar.gz: abe9bf21ac6d66a08f229de3fb10e77bc911c112f812cd0cf620d9f3947d580e
 SHA512:
-  metadata.gz: e6e99bf6a409b960d0432f702b286f7b71b06a34b61ff242d2d75eebc9c125bc02c6daa573efc5af69dfeb7c2f788811fb91d2f6f6decd1a869db26e6a5462e6
-  data.tar.gz: 9c76877de5ba5164f677aad7be9ffb3f905f2fd874523b9f2aaff287abd0ebdd8d8c7272da22eddfcacb56a7eb325392e52e1b2a3b551e8940627b146190a895
+  metadata.gz: b4352492dedad2bd9881b9bc6ac5888cdf7855a798f2b650040a9a64c4f7ea81c34178a4bfadb77f5953d82498f1eea69c90529d8b3888d9d182d3896e8415ed
+  data.tar.gz: b2540b62b29a07666c66969f5d6843f674994747fe80e47e71c0ba7f03ad554ccfbd1fcfefca796b7115f6fa2643f2b57b4d058de755c499a87ac87f883a4282

data/.standard.yml

@@ -9,3 +9,4 @@ ignore:
     - Layout/ArgumentAlignment
     - Style/EmptyCaseCondition
     - Style/RescueModifier
+    - Layout/MultilineMethodCallBraceLayout

data/CHANGELOG.md

@@ -1,5 +1,49 @@
 ## [Unreleased]
 
+## [0.8.0] - 2026-08-08
+
+(Only one change since the last beta: the Faraday bug fix below. Everything
+else shipped in earlier 0.8.0 betas.)
+
+- Optimize signature parsing, serialization, and validation performance
+  across signing and verifying flows, improving `sign!` throughput by
+  473% and `verify!` by 136% by minimizing Starry usage in hot paths
+  where possible.
+
+- Add comprehensive benchmarking and profiling infrastructure across all
+  supported algorithms.
+
+- Make Rack an optional dependency.
+
+- Add Web Bot Auth support, implementing the current IETF draft
+  (draft-meunier-web-bot-auth-architecture-05).
+  Includes recommended signature parameter defaults, nonce generation,
+  and optional Signature-Agent header handling.
+
+- Fix Faraday adapter deriving URI components from a re-encoded query
+  string, which could differ from the URI faraday actually sent and fail
+  verification at the origin. Affected `@target-uri`, `@request-target`
+  and `@query`. The query is now encoded with the request's own
+  `params_encoder`, so it tracks the URL faraday puts on the wire:
+
+  - Spaces no longer always encode as `+`. Faraday honours the
+    process-wide `Faraday::Utils.default_space_encoding`, which other
+    gems may set (the `oauth2` gem sets it to `"%20"` on load), so a
+    query value containing a space signed a URI the verifier could not
+    reproduce.
+
+  - A request with no query parameters no longer appends a stray `?`.
+
+  - A `params_encoder` configured on the connection or request is now
+    preserved, instead of being replaced with the default encoder.
+
+## [0.8.0.beta2] - 2026-05-20
+
+- Add Web Bot Auth support, implementing the current IETF draft
+  (draft-meunier-web-bot-auth-architecture-05).
+  Includes recommended signature parameter defaults, nonce generation,
+  and optional Signature-Agent header handling.
+
 ## [0.8.0.beta1] - 2026-05-07
 
 - Optimize signature parsing, serialization, and validation performance

data/README.md

@@ -490,6 +490,61 @@ anything that to responds to `#to_i`, including an `ActiveSupport::Duration`.
 If the signature is older than the allowed window, verification
 fails with an error.
 
+## Web Bot Auth
+
+Linzer supports the Web Bot Auth authentication mechanism, which allows
+automated clients to identify themselves using HTTP Message Signatures
+(as defined in RFC 9421).
+
+This is useful for distinguishing legitimate automated traffic from
+anonymous or potentially abusive requests.
+
+For more details on Web Bot Auth, refer to the
+[relevant IETF drafts](https://datatracker.ietf.org/wg/webbotauth/documents/)
+or to additional resources such as
+[this Cloudflare article](https://blog.cloudflare.com/web-bot-auth/).
+
+When enabled, as shown in the examples below, Linzer adds the required
+signature headers to identify the client as an automated agent:
+
+- Plain Linzer:
+
+```ruby
+
+Linzer.sign!(
+  request,
+  key:     key,
+  label:   "sig1",
+  profile: :web_bot_auth
+  # or override/set specific parameters like the following:
+  # profile: Linzer::Signing::Profile.web_bot_auth(agent: "https://...")
+)
+```
+
+- http.rb gem:
+
+```ruby
+require "linzer/http/signature_feature"
+
+response = HTTP.headers(date: Time.now.utc.httpdate, foo: "bar")
+               .use(http_signature: {key: key, profile: :web_bot_auth}
+               .get(url)
+```
+
+- Faraday:
+
+```ruby
+require "linzer/faraday"
+
+conn = Faraday.new(url: api_url) do |builder|
+  builder.request :http_signature, key: signing_key,
+                                   components: components,
+                                   profile: :web_bot_auth,
+                                   params: signature_params
+end
+response = conn.post("/task")
+```
+
 ## Supported algorithms
 
 Linzer currently supports the following signature algorithms:

data/lib/faraday/http_signature/middleware.rb

@@ -107,7 +107,16 @@ module Faraday
       #   @return [Boolean] when +true+ (default), raises
       #     {VerifyError} on verification failure; when +false+,
       #     sets +env[:http_signature_verified]+ to +false+ and continues
-      class Options < Faraday::Options.new(:key, :sign_request, :sign_key, :components, :verify_response, :verify_key, :params, :strict)
+      # @!attribute [rw] profile
+      #   Optional HTTP Message Signatures signing profile.
+      #
+      #   When set, the profile is passed to {Linzer.sign!} and may provide
+      #   default covered components and signature parameters.
+      #
+      #   @return [Symbol, Linzer::Signature::Profile::Base, nil]
+      #     a registered profile name, a profile instance, or +nil+ to use
+      #     the default signing behavior
+      class Options < Faraday::Options.new(:key, :sign_request, :sign_key, :components, :verify_response, :verify_key, :params, :strict, :profile)
         # Returns the generic key.
         # @return [Linzer::Key, nil]
         def key
@@ -146,6 +155,13 @@ module Faraday
         def params
           Hash(self[:params])
         end
+
+        # Returns the signing profile configuration.
+        #
+        # @return [Symbol, Linzer::Signature::Profile::Base, nil]
+        def profile
+          self[:profile]
+        end
       end
 
       # Creates a new middleware instance.
@@ -186,10 +202,15 @@ module Faraday
 
         key = resolve_signing_key
         request = Linzer::Faraday::Utils.create_request(env)
-        message = Linzer::Message.new(request)
 
-        signature = Linzer.sign(key, message, options.components, options.params)
-        env.request_headers.merge!(signature.to_h)
+        Linzer.sign! request,
+                     key:        key,
+                     components: options.components,
+                     params:     options.params,
+                     profile:    options.profile
+
+        signature_headers = request.headers.slice("signature", "signature-input")
+        env.request_headers.merge!(signature_headers)
         env
       rescue Linzer::Error => e
         raise SigningError, e if options.strict?

data/lib/linzer/common.rb

@@ -67,7 +67,7 @@ module Linzer
     # @param serialized_components [Array<String>] The covered components
     # @param parameters [Hash] Signature parameters
     # @return [String] The formatted @signature-params line
-    SERIALIZED_SIGNATURE_PARAMS = Starry.serialize("@signature-params").freeze
+    SERIALIZED_SIGNATURE_PARAMS = HTTP::StructuredField.serialize("@signature-params").freeze
     private_constant :SERIALIZED_SIGNATURE_PARAMS
 
     def signature_params_line(serialized_components, parameters)
@@ -136,7 +136,7 @@ module Linzer
           .flat_map
           .with_index do |group, idx|
             group
-              .map  { |comp| Starry.parse_item(idx.zero? ? comp[1..] : comp) }
+              .map  { |comp| HTTP::StructuredField.parse_item(idx.zero? ? comp[1..] : comp) }
               .uniq { |comp| [comp.value, comp.parameters] }
           end
 

data/lib/linzer/faraday/utils.rb

@@ -14,13 +14,20 @@ module Linzer
       # {Linzer::Message::Adapter::Faraday::Request}, preserving the
       # original HTTP method, URL, and headers from the environment.
       #
+      # Preserves the environment's request options when present, so that
+      # a +params_encoder+ configured on the connection or request is
+      # carried over. The adapter re-encodes query parameters when
+      # deriving +@target-uri+ and friends, and must use the same encoder
+      # Faraday used to write the URL, or the signed value will not match
+      # the URI actually sent.
+      #
       # @param env [::Faraday::Env] the middleware environment
       # @return [::Faraday::Request] a new request object
       def self.create_request(env)
         ::Faraday::Request.create(env.method) do |req|
           req.params  = ::Faraday::Utils::ParamsHash.new
           req.headers = ::Faraday::Utils::Headers.new(env.request_headers.dup)
-          req.options = ::Faraday::ConnectionOptions.from(nil).request
+          req.options = env.request || ::Faraday::ConnectionOptions.from(nil).request
           req.url       env.url
         end
       end

data/lib/linzer/helper.rb

@@ -16,12 +16,22 @@ module Linzer
     #
     # @param request_or_response [Net::HTTPRequest, Net::HTTPResponse, Rack::Request,
     #   Rack::Response, HTTP::Request] The HTTP message to sign
-    # @param args [Hash] Keyword arguments
-    # @option args [Linzer::Key] :key The private key to sign with (required)
-    # @option args [Array<String>] :components The components to include in the
-    #   signature (required). Example: `%w[@method @path content-type]`
-    # @option args [String] :label Optional signature label (defaults to "sig1")
-    # @option args [Hash] :params Additional signature parameters (created, nonce, etc.)
+    #
+    # @param key [Linzer::Key]
+    #   The private key to sign with (required)
+    #
+    # @param components [Array<String>]
+    #   The components to include in the signature (required).
+    #   Example: `%w[@method @path content-type]`
+    #
+    # @param label [String, nil]
+    #   Optional signature label (defaults to "sig1")
+    #
+    # @param params [Hash]
+    #   Additional signature parameters (created, nonce, etc.)
+    #
+    # @param profile [Symbol, Linzer::Signature::Profile::Base, nil]
+    #   Optional signing profile
     #
     # @return [Object] The original HTTP message with signature headers attached
     #
@@ -46,17 +56,26 @@ module Linzer
     #     label: "my-sig",
     #     params: { nonce: SecureRandom.hex(16), tag: "my-app" }
     #   )
-    def sign!(request_or_response, **args)
-      message = Message.new(request_or_response)
-      options = {}
+    def sign!(request_or_response, key:, components: nil, label: nil, params: {}, profile: nil)
+      ctx = Signature::Context.new(
+        message:    Message.new(request_or_response),
+        key:        key,
+        label:      label,
+        components: Array(components),
+        params:     Hash(params)
+      )
+
+      resolved_profile = Signature::Profile.resolve(profile)
+      resolved_profile&.apply(ctx)
 
-      label = args[:label]
-      options[:label] = label if label
-      options.merge!(args.fetch(:params, {}))
+      signature = Linzer::Signer.sign(
+        ctx.key,
+        ctx.message,
+        ctx.components,
+        ctx.params
+      )
 
-      key = args.fetch(:key)
-      signature = Linzer::Signer.sign(key, message, args.fetch(:components), options)
-      message.attach!(signature)
+      ctx.message.attach!(signature)
     end
 
     # Verifies a signed HTTP request or response.

data/lib/linzer/http/signature_feature.rb

@@ -53,12 +53,17 @@ module Linzer
       # @param covered_components [Array<String>] Components to include
       #   in the signature. Defaults to `@method`, `@request-target`,
       #   `@authority`, and `date`.
+      # @param profile [Symbol, Linzer::Signature::Profile::Base, nil]
+      #   Optional signing profile used when generating signatures.
+      #   When provided, the profile may supply default covered components
+      #   and signature parameters.
       #
       # @raise [HTTP::Error] If key is nil or invalid
-      def initialize(key:, params: {}, covered_components: default_components)
+      def initialize(key:, params: {}, covered_components: default_components, profile: nil)
         @fields = Array(covered_components)
         @key    = validate_key(key)
         @params = Hash(params)
+        @profile = profile
       end
 
       # @return [Array<String>] The components to include in signatures
@@ -67,6 +72,10 @@ module Linzer
       # @return [Hash] Additional signature parameters
       attr_reader :params
 
+      # @return [Linzer::Signature::Profile::Base, Symbol, nil]
+      #  Optional signing profile used during signature generation
+      attr_reader :profile
+
       # Wraps an outgoing request to add signature headers.
       #
       # Called automatically by http.rb for each request.
@@ -74,9 +83,11 @@ module Linzer
       # @param request [HTTP::Request] The outgoing request
       # @return [HTTP::Request] The request with signature headers added
       def wrap_request(request)
-        message   = Linzer::Message.new(request)
-        signature = Linzer.sign(key, message, fields, **params)
-        request.headers.merge!(signature.to_h)
+        Linzer.sign! request,
+                     key:        key,
+                     components: fields,
+                     params:     params,
+                     profile:    profile
         request
       end
 

data/lib/linzer/http/structured_field.rb

@@ -10,38 +10,135 @@ module Linzer
     # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
     # @see https://www.rfc-editor.org/rfc/rfc9421 RFC 9421
     module StructuredField
-      # Serializes signature parameters to the RFC 8941 string format.
+      InnerList  = Starry::InnerList
+      Item       = Starry::Item
+
+      # Parses an RFC 8941 Structured Field Dictionary.
+      #
+      # @param str [String] the serialized dictionary value
+      # @param field_name [String, nil] optional field name for contextual errors
+      # @return [Hash<String, Object>] parsed structured field dictionary
+      # @raise [Linzer::Error] if the field cannot be parsed
+      #
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.parse_dictionary(str, field_name: nil)
+        Starry.parse_dictionary(str)
+      # rescue Starry::ParseError => ex
+      # https://github.com/takemar/starry/pull/4
+      rescue => ex
+        cannot_parse = "Cannot parse %sfield!"
+        raise Error,
+              cannot_parse % [field_name ? "\"#{field_name}\" " : nil],
+              cause: ex
+      end
+
+      # Parses an RFC 8941 Structured Field Item.
+      #
+      # @param item [String] serialized structured field item
+      # @return [Starry::Item] parsed structured field item
+      # @raise [Linzer::Error] if the item is invalid or unparseable
+      #
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.parse_item(item)
+        Starry.parse_item(item)
+      # rescue Starry::ParseError => ex
+      # https://github.com/takemar/starry/pull/4
+      rescue => ex
+        raise Error, "Invalid/unparseable HTTP field item", cause: ex
+      end
+
+      # Parses an RFC 8941 Structured Field List.
+      #
+      # @param list [String] serialized structured field list
+      # @return [Array<Object>] parsed structured field list members
+      # @raise [Linzer::Error] if the list is invalid or unparseable
+      #
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.parse_list(list)
+        Starry.parse_list(list)
+      # rescue Starry::ParseError => ex
+      # https://github.com/takemar/starry/pull/4
+      rescue => ex
+        raise Error, "Invalid/unparseable HTTP field list", cause: ex
+      end
+
+      # Serializes a dictionary into RFC 8941 Structured Field format.
+      #
+      # @param hsh [Hash] structured field dictionary
+      # @return [String] serialized structured field dictionary
+      # @raise [Linzer::Error] if the dictionary cannot be serialized
       #
-      # Integers are bare, strings are double-quoted. This covers all
-      # parameter types used in RFC 9421 signatures (created, expires,
-      # keyid, nonce, alg, tag).
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.serialize_dictionary(hsh)
+        Starry.serialize_dictionary(hsh)
+      # rescue Starry::SerializeError => ex
+      # https://github.com/takemar/starry/pull/4
+      rescue => ex
+        raise Error, ex.message, cause: ex
+      end
+
+      # Serializes a list into RFC 8941 Structured Field format.
+      #
+      # @param arr [Array] structured field list members
+      # @return [String] serialized structured field list
+      # @raise [Linzer::Error] if the list cannot be serialized
+      #
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.serialize_list(arr)
+        Starry.serialize_list(arr)
+      # rescue Starry::SerializeError => ex
+      # https://github.com/takemar/starry/pull/4
+      rescue => ex
+        raise Error, ex.message, cause: ex
+      end
+
+      # Serializes an object into RFC 8941 Structured Field format.
+      #
+      # @param obj [Object] structured field value
+      # @return [String] serialized structured field value
+      # @raise [Linzer::Error] if the object cannot be serialized
       #
-      # @example Serialize signature parameters
-      #   StructuredField.serialize_parameters(
-      #     created: 1700000000,
-      #     keyid: "my-key"
-      #   )
-      #   # => ';created=1700000000;keyid="my-key"'
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.serialize(obj)
+        Starry.serialize(obj)
+      rescue Starry::SerializeError => ex
+        raise Error, ex.message, cause: ex
+      end
+
+      # Serializes a Structured Field Item into RFC 8941 format.
+      #
+      # This helper serializes a single Structured Field Item, such as
+      # a string, integer, token, boolean, date, byte sequence, or
+      # an already constructed {Starry::Item}.
+      #
+      # @param item [Object] structured field item value
+      # @return [String] serialized structured field item
+      # @raise [Linzer::Error] if the item cannot be serialized
+      #
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
+      def self.serialize_item(item)
+        Starry.serialize_item(item)
+      rescue Starry::SerializeError => ex
+        raise Error, ex.message, cause: ex
+      end
+
+      # Serializes Structured Field Parameters into RFC 8941 format.
       #
-      # @param parameters [Hash{Symbol,String => Object}]
-      #   The parameters to serialize.
+      # Parameters are serialized according to the Structured Fields
+      # parameter syntax defined in RFC 8941 Section 3.1.2.
       #
-      # @return [String]
-      #   The serialized structured field parameter string.
+      # @param parameters [Hash{String,Symbol => Object}] parameter names
+      #   and values
+      # @return [String] serialized structured field parameters
+      # @raise [Linzer::Error] if the parameters cannot be serialized
       #
+      # @see https://www.rfc-editor.org/rfc/rfc8941 RFC 8941
       def self.serialize_parameters(parameters)
-        params_str = +""
-        parameters.each do |key, value|
-          params_str << case value
-          when Integer
-            ";#{key}=#{value}"
-          when String
-            ";#{key}=\"#{value}\""
-          else
-            ";#{key}=#{value}"
-          end
-        end
-        params_str
+        Starry.serialize_parameters(parameters)
+      # rescue Starry::SerializeError => ex
+      # https://github.com/takemar/starry/pull/4
+      rescue => ex
+        raise Error, ex.message, cause: ex
       end
     end
   end

data/lib/linzer/http.rb

@@ -100,12 +100,18 @@ module Linzer
 
       headers    = build_headers(options[:headers] || {})
       request    = build_request(verb, uri, headers)
-      message    = Linzer::Message.new(request)
       components = options[:covered_components] || default_components
       params     = options[:params] || {}
-      signature  = Linzer.sign(key, message, components, **params)
 
-      do_request(http, uri, verb, options[:data], signature, headers)
+      Linzer.sign! request,
+                   key:        key,
+                   components: components,
+                   params:     params,
+                   profile:    options[:profile]
+
+      signature_headers  = request.each_header.to_h.slice("signature-input", "signature")
+
+      do_request(http, uri, verb, options[:data], signature_headers, headers)
     end
 
     # Returns the default covered components for signing.
@@ -180,19 +186,19 @@ module Linzer
     # @param uri [String] the request URI
     # @param verb [Symbol] the HTTP method
     # @param data [String, nil] the request body
-    # @param signature [Linzer::Signature] the generated signature
+    # @param signature_headers [Hash] the generated signature headers
     # @param headers [Hash] request headers
     # @return [Net::HTTPResponse] the response
     # @raise [Linzer::Error] if a body is required but not provided
-    def do_request(http, uri, verb, data, signature, headers)
+    def do_request(http, uri, verb, data, signature_headers, headers)
       if with_body?(verb)
         if !data
           missed_body = "Missing request body on HTTP request: '#{verb.upcase}'"
           raise Linzer::Error, missed_body
         end
-        http.public_send(verb, uri, data, headers.merge(signature.to_h))
+        http.public_send(verb, uri, data, headers.merge(signature_headers))
       else
-        http.public_send(verb, uri,       headers.merge(signature.to_h))
+        http.public_send(verb, uri,       headers.merge(signature_headers))
       end
     end
   end

data/lib/linzer/message/adapter/abstract.rb

@@ -97,26 +97,35 @@ module Linzer
         # Attaches a signature to the underlying HTTP message.
         #
         # @param signature [Signature] The signature to attach
+        # @param additional_headers [#each]
+        #   Additional headers to attach after signature processing.
+        #   Header values overwrite existing values with the same field name.
+        #
         # @return [Object] The underlying HTTP message
-        def attach!(signature)
+        def attach!(signature, additional_headers: {})
           signature_headers = signature.to_h
 
-          unless has_signature?
+          if !has_signature?
             signature_headers.each { |h, v| set_header!(h, v) }
-            return @operation
+          else
+            begin
+              signature_headers.each do |hdr, value|
+                merged = HTTP::StructuredField.parse_dictionary(String(header(hdr)))
+                merged.merge!(HTTP::StructuredField.parse_dictionary(value))
+                set_header!(hdr, HTTP::StructuredField.serialize_dictionary(merged))
+              end
+            rescue Error => ex
+              raise Error,
+                    "Cannot attach signature, invalid signature header(s)!",
+                    cause: ex
+            end
           end
 
-          signature_headers.each do |hdr, value|
-            merged = Starry.parse_dictionary(String(header(hdr)))
-            merged.merge!(Starry.parse_dictionary(value))
-            set_header!(hdr, Starry.serialize_dictionary(merged))
+          if !additional_headers.empty?
+            additional_headers.each { |h, v| set_header!(h, v) }
           end
 
           @operation
-        rescue Starry::ParseError => e
-          raise Error,
-                "Cannot attach signature, invalid signature header(s)!",
-                cause: e
         end
 
         private
@@ -201,8 +210,10 @@ module Linzer
           has_bs  = name.parameters["bs"]
 
           if has_req
-            name.parameters.delete("req")
-            return req(name, method)
+            request_field =
+              HTTP::StructuredField::Item.new(name.value,
+                                              name.parameters.except("req"))
+            return req(request_field, method)
           end
 
           value = send(method, name)
@@ -223,14 +234,16 @@ module Linzer
         # @return [String] the serialized structured field value
         # @see https://www.rfc-editor.org/rfc/rfc9421.html#section-2.1.1
         def sf(value, key = nil)
-          dict = Starry.parse_dictionary(value)
+          dict = HTTP::StructuredField.parse_dictionary(value)
 
           if key
             obj = dict[key]
-            Starry.serialize(obj.is_a?(Starry::InnerList) ? [obj] : obj)
+            HTTP::StructuredField.serialize(obj.is_a?(HTTP::StructuredField::InnerList) ? [obj] : obj)
           else
-            Starry.serialize(dict)
+            HTTP::StructuredField.serialize(dict)
           end
+        rescue Error => _ex
+          nil
         end
 
         # Binary-wraps a field value as a byte sequence.
@@ -239,7 +252,7 @@ module Linzer
         # @return [String] the serialized byte sequence
         # @see https://www.rfc-editor.org/rfc/rfc9421.html#section-2.1.3
         def bs(value)
-          Starry.serialize(value.encode(Encoding::ASCII_8BIT))
+          HTTP::StructuredField.serialize(value.encode(Encoding::ASCII_8BIT))
         end
 
         # Retrieves a trailer field value.

data/lib/linzer/message/adapter/faraday/request.rb

@@ -37,10 +37,24 @@ module Linzer
 
           # Builds the full URI including query parameters.
           #
+          # Encodes the query with the request's own +params_encoder+,
+          # mirroring how faraday builds the URL it puts on the wire
+          # (+Faraday::Connection#build_env+). Encoding it independently
+          # here would diverge from the URI actually sent: notably
+          # +URI.encode_www_form+ always encodes a space as +++, while
+          # faraday honours the process-wide
+          # +Faraday::Utils.default_space_encoding+, which other gems may
+          # set to +%20+. The signer would then cover a +@target-uri+ the
+          # verifier cannot reproduce from the request it received.
+          #
+          # An empty query is left as +nil+ rather than +""+, as assigning
+          # +""+ would append a stray +?+ that faraday does not send.
+          #
           # @return [URI] the complete request URI with encoded query string
           def uri
             uri = @operation.path.dup
-            uri.query = URI.encode_www_form(@operation.params)
+            query = @operation.params.to_query(@operation.options.params_encoder)
+            uri.query = query unless query.empty?
             uri
           end
 

data/lib/linzer/message/adapter/generic/request.rb

@@ -72,6 +72,7 @@ module Linzer
           end
 
           def query_param(uri_query, name)
+            return nil if !uri_query
             param_name = name.parameters["name"]
             return nil if !param_name
             decoded_param_name = URI.decode_uri_component(param_name)