Understanding AuthClient flow with SIWE as stated in the docs, mismatch in signature validation #3384
Unanswered
thedonmon
asked this question in
Developer Support
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I have a dapp that requires a signed message using the SIWE package in Go on the server to verify the signature. Once that signature is verified, on the server given the message string which is just a stringified version of the SIWE message, and signature as a result a token is issued from the server and user is logged in. This works completely fine for Web wallets extensions however running into some difficulty now with the new AuthClient on mobile flow using the FlutterSDK.
For WalletConnectV2 the docs state that the signature is automatically validated with SIWE. If this is the case, how can I verify the signature on the server side that gets returned from the AuthClient? For example, the SIWE package expects an integer for chain ID, as well as missing AUD, so parsing the message out to a SIWE object will already fail, since the message signed using AuthClient will be different.
Sample response from AuthClient, statement is already in a different format:
{id: 1691430503789352, jsonrpc: 2.0, result: {h: {t: eip4361}, p: {aud: http://myapp.me/, domain: myapp.me, version: 1, nonce: 78e0a804e61846679d4c8670fbb349d1, iat: 2023-08-07T23:18:23.789582, statement: Authenticate with MyApp, chainId: 1, iss: did:pkh:eip155:1:0x95c3bcC26D5B3B0F4A7aE2E7f0aF69d4aB598Ae5}, s: {s: 0xfe8cc0f365c91e6bb55e012dd67085ca3c4e80b67be55725f66b190565db9c467cfd9e7459f391fe0d191626e887ae03b1138697c1cb0265290c94055029f6061b, t: eip191}}}
When calling Verify191 in SIWE the message that is constructed, assuming it follows the SIWE format and the correct values are used, the message string that gets signed by the AuthClient will actually be different so the signature verification fails when parsing the publickey
TL;DR: What would be the flow now to verify a signed message that comes from the authclient given that the reconstruction and verifying signature on the server side is no longer needed? I still need some verification serverside to issue a JWT for a dapp. Also it very well could be a bug with the spruceId package and being compatible with WalletConnectV2 for this case, and if so wondering if I can be pointed in the right direction maybe make a PR to fix it
Beta Was this translation helpful? Give feedback.
All reactions