fix(web3): enforce SIWE Expiration Time without Not Before - #2688
Open
SashaMIT wants to merge 1 commit into
Open
fix(web3): enforce SIWE Expiration Time without Not Before#2688SashaMIT wants to merge 1 commit into
SashaMIT wants to merge 1 commit into
Conversation
Ethereum web3Grant gated the expiry check on NotBefore != nil, so a common SIWE message with only Expiration Time stayed acceptable until IssuedAt + MaximumValidityDuration. Align with the Solana path and reject expired messages regardless of Not Before. Signed-off-by: Sasha Mitchell <sash@ela.city>
2 tasks
jxom
added a commit
to wevm/viem
that referenced
this pull request
Aug 13, 2026
* fix(siwe): reject unparseable expirationTime and notBefore Invalid Date values from parseSiweMessage (e.g. Expiration Time: never) are truthy, so comparisons like `time >= expirationTime` are always false and lifetime / nbf checks were skipped. Fail closed when either field is present but not a real date (sibling of thirdweb-dev/js#8875 / supabase/auth#2688). * fix(siwe): require EIP-4361 date-time strings and reject invalid time Validate raw SIWE timestamps against the RFC 3339 profile before Date coercion, and fail closed when the caller-supplied time is invalid so lifetime comparisons cannot be skipped. * fix(siwe): inline date validation --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com>
jxom
added a commit
to wevm/viem
that referenced
this pull request
Aug 14, 2026
* feat: add block header watcher (#4999) * fix: complete block header watcher integration (#5001) * chore: version package (#5000) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(tempo): bind encrypted deposits to sender (#5002) * fix(tempo): bind encrypted deposits to sender Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * ci: test sender-bound zone deposits * ci: align Tempo and Zone fixtures * test(tempo): routed T10 fixtures through encrypted deposits * chore: logged local Zone provisioning stall * chore: ignored unpatched extract-zip advisory * fix(tempo): defaulted encrypted deposit sender * ci: skipped Wagmi verification * chore: remove friction log --------- Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Steven Truong <struong@users.noreply.github.com> Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * chore: version package (#5003) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(siwe): reject unparseable expirationTime and notBefore (#4990) * fix(siwe): reject unparseable expirationTime and notBefore Invalid Date values from parseSiweMessage (e.g. Expiration Time: never) are truthy, so comparisons like `time >= expirationTime` are always false and lifetime / nbf checks were skipped. Fail closed when either field is present but not a real date (sibling of thirdweb-dev/js#8875 / supabase/auth#2688). * fix(siwe): require EIP-4361 date-time strings and reject invalid time Validate raw SIWE timestamps against the RFC 3339 profile before Date coercion, and fail closed when the caller-supplied time is invalid so lifetime comparisons cannot be skipped. * fix(siwe): inline date validation --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * fix: asset discovery in `simulateCalls` (#4997) * fix(simulateCalls): discover assets from simulated logs * refactor(simulateCalls): align asset discovery with repo conventions * fix(simulateCalls): pin both asset-tracing passes to one base block * test(simulateCalls): skip asset tracing on the pinned Anvil * chore: update accessListHints comment * fix(simulateCalls): preserve block tags and request errors * fix(simulateCalls): harden asset trace discovery * test: use reth for mainnet forks * test(simulateCalls): run asset tracing against reth * fix(simulateCalls): align asset trace simulations * fix(simulateCalls): stabilize asset tracing * chore: add static call source * fix(simulateCalls): simplify asset tracing * fix(simulateCalls): isolate asset balance probes * fix(simulateCalls): align asset probe callers * fix(simulateCalls): preserve pending block tag * fix(simulateCalls): normalize transfer topics * refactor(simulateCalls): remove redundant asset deduplication * test(simulateCalls): cover asset tracing edge cases * docs(simulateCalls): describe pending asset tracing --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * fix: update nanoid security override * fix: increase package size limits * ci: remove docs deployment --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: struong <steven@tempo.xyz> Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Steven Truong <struong@users.noreply.github.com> Co-authored-by: Sash <sash@ela.city> Co-authored-by: Ghadi <92851745+Ghadi8@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
web3GrantrequiredNotBefore != nilbefore checkingExpirationTime, so SIWE logins that set only Expiration Time (common shape) were accepted past expiry untilIssuedAt + MaximumValidityDuration(default 10m).ExpirationTimealone; Ethereum now matches.Test plan
TestValidationRules_Expiredwith an Ethereum message that has Expiration Time and no Not Before (RED without fix → "issued too long ago"; GREEN with fix → "is expired")go test ./internal/api/ -run 'TestWeb3/TestValidationRules_Expired' -count=1Tip:
dc5bf8e8. SSH-signed under SashaMIT.Tooling assist: Cursor (author owns the change).
Made with Cursor