FORGET IPS: USING CRYPTOGRAPHY TO VERIFY BOT AND AGENT TRAFFIC

Summary from the TLDR InfoSec newsletter

In the era of AI agents, not all bot traffic is malicious. Cloudflare proposed two mechanisms for “good bots” to self-identify. The first is HTTP Message Signatures, which adds a Signature-Input header with a signature, validity period, usage tag, and a Signature-Agent header to locate the key. The second option is a new TLS flag, req_mTLS, which allows clients to indicate support for mutual TLS and identify the bot.