You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The use of @stablelib/random which is calling randomStringForEntropy to generate a nonce is a bit problematic when building a React app (I am using vite if that matters). Getting a bunch of issues like:
Uncaught TypeError: Failed to resolve module specifier "crypto". Relative references must start with either "/", "./", or "../".
Uncaught TypeError: Failed to resolve module specifier "buffer". Relative references must start with either "/", "./", or "../".
etc
I think these may be addressed by polyfilling, but it's actually unnecessary for the nonce to be secure / crypto random at all. The nonce is always kept in plain text, and the use is just to prevent replay attacks. In fact, the nonce could just be an incrementing integer, but then you would have to track the state of course, so not recommending this. However, you could just use UUID because the odds of collision on a UUID is low enough for this to serve as a nonce. In fact, you could probably accept a function that returns a nonce in a promise and allow the devs who consume SIWE to specify a function that produces a nonce.
The text was updated successfully, but these errors were encountered:
The use of @stablelib/random which is calling randomStringForEntropy to generate a nonce is a bit problematic when building a React app (I am using vite if that matters). Getting a bunch of issues like:
etc
I think these may be addressed by polyfilling, but it's actually unnecessary for the nonce to be secure / crypto random at all. The nonce is always kept in plain text, and the use is just to prevent replay attacks. In fact, the nonce could just be an incrementing integer, but then you would have to track the state of course, so not recommending this. However, you could just use UUID because the odds of collision on a UUID is low enough for this to serve as a nonce. In fact, you could probably accept a function that returns a nonce in a promise and allow the devs who consume SIWE to specify a function that produces a nonce.
The text was updated successfully, but these errors were encountered: