SIWE ExpirationTime check skipped when NotBefore is absent
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- go
- Domain
- authentication
Research direction
Start at the web3GrantEthereum handler and inspect how SIWE NotBefore and ExpirationTime are validated. Compare its independent expiration handling with the Solana handler shown in the issue. Done means a SIWE message with an expirationTime but no notBefore is rejected after it expires, while the existing validity fallback remains unchanged.
Written by the indexing model from the issue text.
Description
In web3GrantEthereum, the expiration time check for SIWE messages is gated on NotBefore != nil:
if parsedMessage.NotBefore != nil && parsedMessage.ExpirationTime != nil && !parsedMessage.ExpirationTime.IsZero() && now.After(*parsedMessage.ExpirationTime) {
Per EIP-4361, not-before and expiration-time are independent optional fields. A SIWE message can specify an expirationTime without a notBefore. When that happens, the entire expiration check is skipped and the expired message is accepted.
The Solana handler checks them independently and doesn't have this issue:
if !parsedMessage.ExpirationTime.IsZero() && now.After(parsedMessage.ExpirationTime) {
The MaximumValidityDuration fallback doesn't help here because it's a broader window based on IssuedAt, not the per-message ExpirationTime. A message that sets a 5-minute expiration would still be accepted for the full MaximumValidityDuration window.
Removing parsedMessage.NotBefore != nil && from the condition fixes it.
- Dominant language
- Go
- Stars
- 2.6k
- Forks
- 764
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/auth
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100