agentic‑readiness docs
/
Scan at scale Blog Build one › Run a scan ›
Menu

Scan at scaleSites with a broken Web Bot Auth directory

Sites with a broken Web Bot Auth directory

A site-wide report: one row per host, over the web_bot_auth rows the crawl emitted.

What this report returns

Web Bot Auth lets a site prove its outbound bots' identity: verifiers fetch the site's public keys from a JWKS directory at /.well-known/http-message-signatures-directory and check request signatures against them.

A row appears here when any of these is wrong, worst first:

  • Malformed DirectoryThe served file isn't a conformant JWKS (invalid JSON, or its "keys" isn't an array per RFC 7517), so no keys can be read.Fix Serve {"keys": [ ...JWKs... ]} as valid JSON.
  • Missing KeysThe JWKS is served but lists no keys, so there's nothing to verify signed bot requests against.Fix Publish the bot's public verification key(s) in the keys array.
  • Invalid KeyKeys are listed but none carries usable public verification material for HTTP message signatures (Ed25519, EC P-256/P-384, or RSA with well-formed base64url params). A key whose material is sound but whose "alg" is mislabelled is NOT this defect: that is Unregistered Alg Name, and it is a one-word fix.Fix Publish a conformant public JWK, e.g. an OKP Ed25519 key with a valid base64url "x".
  • Test KeyThe directory publishes one of RFC 9421's example keys, whose private half is printed in the RFC: verifiers that follow the draft reject your bots, and any that don't would accept forgeries from anyone. RFC 9421 allows these keys only for testing.Fix Generate a new key pair, publish only its public half, and sign with it.
  • Wrong Media TypeThe directory isn't served with the draft's required media type (a missing Content-Type also fails), so strict verifiers reject the response.Fix Set Content-Type: application/http-message-signatures-directory+json on the response.
  • Unregistered Alg NameA key's material is fine, but its "alg" names no signature algorithm for that key (an encryption algorithm such as A128GCM, or another curve's name), so a verifier that honours alg cannot use it. Either spelling of the right algorithm is accepted, e.g. "ed25519" or "Ed25519" for an Ed25519 key.Fix Name the key's own algorithm, or leave alg out.

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

  • Hosthost
  • Web Bot Auth ValidwebBotAuthValid
  • Web Bot Auth Conformance Issue DetectedwebBotAuthConformanceIssueDetected
  • Web Bot Auth Security Risk DetectedwebBotAuthSecurityRiskDetected
  • Web Bot Auth FindingswebBotAuthFindings
  • Web Bot Auth Key TypeswebBotAuthKeyTypes
  • Web Bot Auth Served Media TypewebBotAuthServedMediaType
  • Web Bot Auth Malformed DirectorywebBotAuthMalformedDirectory
  • Web Bot Auth Missing KeyswebBotAuthMissingKeys
  • Web Bot Auth Invalid KeywebBotAuthInvalidKey
  • Web Bot Auth Private Key ExposedwebBotAuthPrivateKeyExposed
  • Web Bot Auth Test KeywebBotAuthTestKey
  • webBotAuth HTTPS DowngradewebBotAuthInsecureRedirect
  • Web Bot Auth Weak RSA KeywebBotAuthWeakRsaKey
  • Web Bot Auth Wrong Media TypewebBotAuthWrongMediaType
  • Web Bot Auth Unregistered Alg NamewebBotAuthUnregisteredAlgName
  • Ruleset VersionrulesetVersion
  • Security Check StatussecurityCheckStatus
  • Related Security FrameworkssecurityFrameworkReferences

About Web Bot Auth directory

Public keys letting verified agents prove who they are.

Read how Web Bot Auth directory is checked, including the specification it is validated against and a worked correct and broken example.

Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.

Get Lumar pricing