Define @target-uri context behind reverse proxies

[aurel-fr]

Location

§6.1, §11.2 line 1133, and §20 line 1458.

Problem

Holder-bound signatures cover @target-uri, but the draft does not fully define how a verifier behind a CDN, gateway, or reverse proxy obtains the client-visible, pre-rewrite URI.

RFC 9421 requires an application or profile to specify this component context, especially when the verifier sees a transformed request.

Required resolution

Require deployments to:

• derive @target-uri from the same pre-rewrite context used by the signer;
• verify before rewriting, use trusted configuration, or use authenticated intermediary-provided context;
• never derive security-relevant URI components from client-controlled forwarding metadata; and
• use the same trusted external-origin context for policy selection and attestation audience.

If the required context is unavailable, validation is unverifiable. If the correct context is known and the signature fails, it is invalid.