Open ouato opened 1 year ago
Hi,
you're totally right -- since making this library I have built a few systems that address this, but I'm not sure it should be part of this repo, I'll leave this issue open to add to README or something.
The way you'd do it is as follows:
/get-nonce
that simply generates a random string and assigns it to their session, and returns it. so for the message to sign, 'some message' becomes 'some message' + nonce/get-nonce
before creating signature, append to message, and sign.
Hi,
I see a security issue in the current flow: if a man in the middle catches the message and the signature, he can reuse the same message and signature at will to fake he is the rightful owner of a wallet.
In order to prevent that, I am trying to sign random messages coming from the backend, and not any message "provided" by the client. At this time, I don't see how to check that the message that was signed is the one I first provided from the backend (through prior call). I would need that onAuth has access to the message signed (no need for signature as it is checked by the lib already).
Thank you for your work!
For reference, I was trying to implement this good article: https://www.toptal.com/ethereum/one-click-login-flows-a-metamask-tutorial#how-the-login-flow-works