Skip to content

feat: controller-utils: Add Sign-in-with-Ethereum origin validation#1163

Merged
legobeat merged 12 commits intoMetaMask:mainfrom
legobeat:siwe-origin-validation
Apr 21, 2023
Merged

feat: controller-utils: Add Sign-in-with-Ethereum origin validation#1163
legobeat merged 12 commits intoMetaMask:mainfrom
legobeat:siwe-origin-validation

Conversation

@legobeat
Copy link
Copy Markdown
Contributor

@legobeat legobeat commented Apr 4, 2023

Sign-in-with-Ethereum origin validation

  • Add function isValidSIWEOrigin for origin validation of SIWE requests

Description

This is intended as a starting point and the current validation logic needs to be replaced or extended before merging.

  • ADDED:

    • controller-utils: Add function isValidSIWEOrigin for origin validation of SIWE requests

Checklist

  • Tests are included if applicable
  • Any added code is fully documented

Issue

@legobeat legobeat added enhancement New feature or request DO-NOT-MERGE labels Apr 4, 2023
Comment thread packages/controller-utils/src/siwe.ts Outdated
Comment thread packages/controller-utils/src/siwe.test.ts Outdated
Comment thread packages/controller-utils/src/siwe.ts Outdated
@legobeat
Copy link
Copy Markdown
Contributor Author

legobeat commented Apr 6, 2023

Updated with proposal of new implementation of validation logic. For context see comment thread in MetaMask/metamask-extension#18188.

Test cases in siwe.test.js serve as reference for what's intended pass/fail for various scenarios.

Comment thread packages/controller-utils/src/siwe.test.ts Outdated
@legobeat legobeat force-pushed the siwe-origin-validation branch from bd00648 to b9b9ea7 Compare April 10, 2023 08:41
Comment thread packages/controller-utils/src/siwe.ts Outdated
Copy link
Copy Markdown
Contributor

@naugtur naugtur Apr 18, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is URL() not used here? It would parse the origin to an object representation and let us remap the fields onto what we need.

Copy link
Copy Markdown
Contributor Author

@legobeat legobeat Apr 19, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Main motivation being transparency (in terms of implementation) and flexibility (in case expected behavior would change).

I just pushed changes which replace both of the custom parsing implementations with URL(). As you note, the origin is the more obvious one.

https://github.com/MetaMask/core/pull/1163/files#diff-c7f76a57f21551632599e2cfb0cda2a7bd6e893fdf38e15b3ab49fd4420402e5R73 feels so-so, so I'm open to reverting the parseDomainParts part but mostly agnostic on which approach we use here.

Comment thread packages/controller-utils/src/siwe.ts Outdated
@legobeat legobeat force-pushed the siwe-origin-validation branch from 98cc110 to 3b7cb0a Compare April 18, 2023 22:40
return true;
} catch (e) {
log(e);
return false;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@legobeat legobeat force-pushed the siwe-origin-validation branch from 212cac2 to 2a06bc1 Compare April 19, 2023 02:55
@legobeat legobeat requested a review from naugtur April 19, 2023 02:58
@legobeat legobeat requested a review from digiwand April 19, 2023 10:35
@legobeat legobeat requested review from a team and danjm April 20, 2023 03:22
digiwand
digiwand previously approved these changes Apr 20, 2023
Copy link
Copy Markdown
Contributor

@digiwand digiwand left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm! nice implementation with tests! helpful change to provide better accuracy for domain binding warnings.

2 related notes for future iteration:

  • I think when we introduce developer-mode and further restrict domain binding, we will want to update this logic. maybe we can consider providing the mismatched parts to the UI in this future iteration
  • maybe we can consider running the check where we call detectSIWE and providing the value in the msgParams if the value will be handy in other places. In other words, we could replace calls to detectSIWE with something like detectSIWEAndCheckDomainBinding

Comment thread packages/controller-utils/src/siwe.ts
@legobeat legobeat force-pushed the siwe-origin-validation branch from c766fee to 4ab1f02 Compare April 20, 2023 23:06
Comment thread packages/controller-utils/src/siwe.ts
@legobeat legobeat merged commit ed49517 into MetaMask:main Apr 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: SIWE domain binding should handle port appropriately

3 participants