Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

@stablelib/random problematic introduces node dependencies #150

Open
denzil-renderheads opened this issue Mar 13, 2023 · 1 comment
Open

Comments

@denzil-renderheads
Copy link

The use of @stablelib/random which is calling randomStringForEntropy to generate a nonce is a bit problematic when building a React app (I am using vite if that matters). Getting a bunch of issues like:

  • Uncaught TypeError: Failed to resolve module specifier "crypto". Relative references must start with either "/", "./", or "../".
  • Uncaught TypeError: Failed to resolve module specifier "buffer". Relative references must start with either "/", "./", or "../".
    etc

I think these may be addressed by polyfilling, but it's actually unnecessary for the nonce to be secure / crypto random at all. The nonce is always kept in plain text, and the use is just to prevent replay attacks. In fact, the nonce could just be an incrementing integer, but then you would have to track the state of course, so not recommending this. However, you could just use UUID because the odds of collision on a UUID is low enough for this to serve as a nonce. In fact, you could probably accept a function that returns a nonce in a promise and allow the devs who consume SIWE to specify a function that produces a nonce.

@tonievictor
Copy link

Could you give more clarification on this issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants