Where the signature is ECDSA-SHA256-DER over the ASCII string
<usdid_uuid>.<timestamp> signed with the same EC P-256 private key the
device used for IGUSDIDRegistrationMutation. The header is computed once
(around USDID registration time) and reused byte-identical on every
subsequent request for the session.
The timestamp in the dumps is always JWS.exp - 2 — i.e. iat + 3598
when the standard 3600s TTL is used. The header therefore expires ~2s
before the registration JWS.
Builds the
x-meta-usdidHTTP header value.Format observed on Instagram Android (9 captures across 6 dumps):
Where the signature is ECDSA-SHA256-DER over the ASCII string
<usdid_uuid>.<timestamp>signed with the same EC P-256 private key the device used forIGUSDIDRegistrationMutation. The header is computed once (around USDID registration time) and reused byte-identical on every subsequent request for the session.The
timestampin the dumps is alwaysJWS.exp - 2— i.e.iat + 3598when the standard 3600s TTL is used. The header therefore expires ~2s before the registration JWS.