Validate signatures against the provider's exact public stream URL

Validate signatures against the provider's exact public stream URL

When a provider signs a streaming handshake URL, validate the exact public URL used to open that stream. Do not replace its scheme with the HTTP transport scheme seen by the application framework or reverse proxy. A mathematically correct validator can reject every legitimate stream when it receives a different URL string. Verify the signing input with a real provider request and the installed SDK, and retain negative tests for altered URLs and invalid signatures. Provider-specific slash normalization may need a documented compatibility variant; successful signature verification still does not establish that audio or conversation completes.

Applies when: A signed streaming handshake crosses a reverse proxy or framework transport boundary. Keywords: websocket signature public URL proxy scheme handshake validation rejection