feat(auth): introduce signed-request authentication with replay protection#1612
Open
oche2920 wants to merge 1 commit into
Open
feat(auth): introduce signed-request authentication with replay protection#1612oche2920 wants to merge 1 commit into
oche2920 wants to merge 1 commit into
Conversation
…ction
Replaces header-only identification in actor.ts with cryptographic proof
of Stellar key ownership via Ed25519 signed requests.
Canonical payload (domain-separated, no challenge round-trip):
stealth-auth:v1:<METHOD>:<PATH>:<TIMESTAMP>:<NONCE>
New headers:
x-stealth-address verified Stellar G-address (claimed public key)
x-stealth-timestamp ISO 8601 UTC timestamp
x-stealth-nonce caller-chosen opaque string (8-128 chars)
x-stealth-signature 128-char lowercase hex Ed25519 signature
Security properties:
- Expiration: timestamps outside +/-5 min window are rejected
- Replay protection: (address, nonce) digest stored for the window;
reused nonces rejected; only SHA-256 digest persisted, never raw values
- Domain separation: stealth-auth:v1 prefix prevents cross-protocol reuse
- Signature verification: Keypair.verify() from @stellar/stellar-sdk
Exports:
verifySignedRequest - core verifier, returns VerifiedActor
requireVerifiedActor - route helper, returns address string
requireVerifiedActorMatches - route helper with ownership assertion
buildCanonicalPayload - shared by client and server
26 unit tests covering happy path, expiration, invalid signatures,
tampered payloads, nonce bounds, replay rejection, and digest privacy.
Closes Stellar-Mail#1459
Collaborator
|
@oche2920 fix ci... Just format the code wiry prettier all should be fine |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces header-only identification in actor.ts with cryptographic proof
of Stellar key ownership via Ed25519 signed requests.
Canonical payload (domain-separated, no challenge round-trip):
stealth-auth:v1::::
New headers:
x-stealth-address verified Stellar G-address (claimed public key)
x-stealth-timestamp ISO 8601 UTC timestamp
x-stealth-nonce caller-chosen opaque string (8-128 chars)
x-stealth-signature 128-char lowercase hex Ed25519 signature
Security properties:
reused nonces rejected; only SHA-256 digest persisted, never raw values
Exports:
verifySignedRequest - core verifier, returns VerifiedActor
requireVerifiedActor - route helper, returns address string
requireVerifiedActorMatches - route helper with ownership assertion
buildCanonicalPayload - shared by client and server
26 unit tests covering happy path, expiration, invalid signatures,
tampered payloads, nonce bounds, replay rejection, and digest privacy.
Closes #1459