Repr-Digest

Verifying a complete representation, even when only part of the message arrives, requires a digest scoped to the representation rather than the message. The Repr-Digest request and response header carries integrity digests computed over the entire selected representation, including any applied content coding.

Table of Contents

Usage

The Repr-Digest header enables verification of representation integrity by computing a digest over the entire selected representation data. Representation data includes the applied Content-Encoding, so a gzip-coded and a Brotli-coded response for the same resource carry different Repr-Digest values. The digest is independent of transfer codings and of how much of the representation a single message transmits.

Servers send Repr-Digest so recipients hold a digest of the whole representation even when a message delivers only part of the content. A Range response covers a slice of the representation: Content-Digest changes with each partial response while Repr-Digest stays constant for the full representation. A digest of the content before any coding is applied is the role of the separate Unencoded-Digest field.

The header uses the Structured Fields Dictionary format, pairing algorithm identifiers with Base64-encoded digest values. Multiple algorithms appear in a single header when content negotiation or algorithm agility is needed.

Clients request specific digest algorithms using Want-Repr-Digest. Servers respond with preferred algorithms when no explicit request is made. Both headers work in requests and responses, and Repr-Digest also works as a trailer field when computing digests incrementally.

The Repr-Digest header complements Content-Digest by operating at the representation layer rather than the message layer. Content-Digest covers the transmitted message content, while Repr-Digest covers the complete representation. For a full response with no range selection the two fields describe the same bytes and carry equal values.

Algorithms

sha-256

The sha-256 algorithm produces a 256-bit digest using the SHA-256 cryptographic hash function. This algorithm suits most integrity verification needs and is widely supported.

sha-512

The sha-512 algorithm produces a 512-bit digest using the SHA-512 cryptographic hash function. This algorithm provides stronger cryptographic properties for contexts requiring additional security margin.

Example

A server sends a SHA-256 digest of the complete representation. The Base64-encoded value is computed over the representation data, including any content coding, and stays valid regardless of transfer framing.

Repr-Digest: sha-256=:d435Qo+nKZ+gLcUHn7GQtQ72hiBVAgqoLsZnZPiTGPk=:

Multiple algorithms appear when the server supports algorithm negotiation. The recipient selects the strongest recognized algorithm and verifies the representation against the corresponding digest value.

Repr-Digest: sha-256=:d435Qo+nKZ+gLcUHn7GQtQ72hiBVAgqoLsZnZPiTGPk=:, sha-512=:db2D3SH1CNTyTJxiKmEAF1n1zqTFmPPxSDO3TYOYBcI=:

A partial response shows the two digest fields diverge. The 206 delivers bytes 10-18 of a 19-byte JSON representation: Repr-Digest still describes the complete representation, while Content-Digest covers only the transmitted bytes of this message.

HTTP/1.1 206 Partial Content
Content-Type: application/json
Content-Range: bytes 10-18/19
Content-Digest: sha-256=:jjcgBDWNAtbYUXI37CVG3gRuGOAjaaDRGpIUFsdyepQ=:
Repr-Digest: sha-256=:RK/0qy18MlBSVnWgjwz6lZEWjP/lF5HF9bvEF8FabDg=:

See also

Last updated: August 11, 2026