spruceid / siwe-py

A Python implementation of Sign-In with Ethereum
https://login.xyz
Apache License 2.0
66 stars 28 forks source link

clarify intended behavior of `validate` #25

Closed 0xdaem0n closed 2 years ago

0xdaem0n commented 2 years ago

The validate and verify functions (unclear of the distinction, but appears to be discussed in https://github.com/spruceid/siwe-py/issues/24) has an inconsistent implementation in nearly every language. I am curious what the intended implementation is, totally understand that different languages have different idioms to adhere to.

In particular, Javascript looks to be the outlier with its behavior - it does validate the message but additionally returns the message. However, it's also the language with the most adoption / usage, so I assumed it was the 'canonical' approach.

Happy to help with the changes if we can confirm the desired behavior, thanks for working on the protocol!

awoie commented 2 years ago

We are currently harmonizing our APIs across languages (should be finished this week) and we can then revisit this issue.

sbihel commented 2 years ago

The naming is now unified accross the libraries, #27 for the Python one. verify is to verify the signature, nonce, etc. validate if present (it is a constructor in most languages) validates the formatting of a message.

As for the return type, it simply depends on what the underlying ethereum/secp256k1 library returns, and the language's idioms.