search

getAlby / bitcoin-connect

Connecting lightning wallets to your webapp has never been easier. Enable WebLN in all browsers with a single button
https://bitcoin-connect.com
MIT License
79 stars 26 forks source link

Docs should mention if you manually set window.webln, you should listen to the onDisconnected event and remove it from the window #215

Open nostrband opened 2 months ago

nostrband commented 2 months ago

If I save the provider in (i.e. in window.webln) and client disconnects the wallet I can still pay with saved window.webln, tested with Alby connection. This shouldn't happen, if client clicks disconnect then there should be no way for the app to access the wallet.

rolznz commented 2 months ago

I would be happy for a PR for this if you know a good solution. Would it just be deleting webln from the window object?

nostrband commented 2 months ago

I guess the provider could start throwing exceptions on all access methods?

rolznz commented 2 months ago

But how do we tell the provider to do that? Maybe we could propose a disable method in webln https://www.webln.guide/building-lightning-apps/webln-reference

nostrband commented 2 months ago

I was talking about Alby NWC connection, it's probably harder to do when BC just wraps the existing webln provider.

rolznz commented 2 months ago

@nostrband do you use Bitcoin Connect v3? by default it will not set window.webln. If you decide to set it yourself, then you must also delete it when the user disconnects their wallet

nostrband commented 2 months ago

Yeah I'm using v3 and I'm clearing window.webln after disconnect

rolznz commented 2 months ago

@nostrband so is there anything we can do here? or should we update the docs so it's clear if you set window.webln you should also listen to the disconnected event and delete window.webln?

nostrband commented 2 months ago

Hmm ok maybe it should be the app's job to react to disconnect properly. Especially given that if you're just forwarding the existing webln provider then it's harder to make it get "disconnected" if app saves a reference to it and doesn't react to disconnect properly.

I guess onConnected docs could state that this provider object may still be usable even after user clicks "disconnect" so app should react to onDisconnected properly.

rolznz commented 2 months ago

Thanks @nostrband for the clarification.