feat: Implement SIWE nonce-based authentication#109
feat: Implement SIWE nonce-based authentication#109tusharshah21 wants to merge 3 commits intoTheSoftwareDevGuild:mainfrom
Conversation
tusharshah21
requested review from
Teddy1792,
joelamouche and
oscarwroche
as code owners
| let rows = sqlx::query!( | ||
| r#" | ||
| SELECT address, name, description, avatar_url, github_login, created_at, updated_at | ||
| SELECT address, name, description, avatar_url, github_login, login_nonce, created_at, updated_at |
There was a problem hiding this comment.
Either the login nonce shouldn't be selected here, or it should be filtered out at the application level
There was a problem hiding this comment.
@tusharshah21 To be more precise, edit the fields that are returned in the get_profile and get_all_profiles queries alongside the DTOs so that the login_nonce field isn't returned from the API.
Also it would be good to move get_profile and get_all_profiles to the queries folder because they belong there, not in commands (my fault !).
oscarwroche
left a comment
oscarwroche
left a comment
There was a problem hiding this comment.
Good work! You can move on to the frontend @tusharshah21 if that's OK with you - you can make a PR from a branch based on this branch into this branch (if that makes sense)
|
got your point used my quantum calculator to see who is this here! |
|
closed because done in #112 |
3 participants
This implements proper replay attack protection by ensuring
each authentication uses a unique nonce that increments after use.
Closes #42