Note

Medium Risk
Touches session authorization, origin allow-listing, and decryption metadata parsing, so regressions could break login/session establishment across platforms. No new external dependencies, but error-handling behavior and sample credentials were changed.

Overview
Session authorization requests are corrected and hardened. Web3AuthApi.authorizeSession now derives the origin header from the provided redirect URL (authority only) and simplifies JSON deserialization handling.

Session creation now uses a specific allowed origin instead of a wildcard. Calls to createSession in Web3Auth.cs pass the current redirect URL rather than "*", tightening origin constraints.

Store response parsing is made more robust. Web3Auth.cs adds parseShareMetadataFromStoreMessage to handle both direct and wrapped ({ value: ... }) share-metadata formats, and adds stricter null/field validation with updated log messages in both authorize and timeout flows.

Sample config is updated. The sample scene/script updates the embedded clientId value (and removes a BOM in Web3AuthSample.cs).

^{Written by Cursor Bugbot for commit 17c19f0. Configure here.}