How is origin defined for signing an authentication request?

Question

How is origin defined for signing an authentication request?

alesito85 opened this issue 5 years ago · 6 comments

So in case of Scatter Desktop the origin is always "file://". Is there any way that an app that is requesting authentication receives the origin that has been used to sign the request?

Is there any case when an origin might be something else or can it be manually set in scatterjs-eos2?

Answer 1 · 2019-12-02T05:27:48.000Z

Err, not sure how origin would even be file://?
Are you trying to use it from a vanilla html/js file without hosting it?

Answer 2 · 2019-12-02T11:54:46.000Z

This seems to have been hardcoded for Scatter Desktop. The only issue is that this hasn't been documented and it's hard to do signature verification one doesn't know how is the message composed. Or I'm missing something...

Answer 3 · 2019-12-04T05:42:04.000Z

What it hardcoded?

The only way I can think of that it gets a file:// prefix, is if you are just opening an html file from your computer without hosting it through a local server like http-server, nginx, or apache. There is no special logic for that (or even handling afaik) since that isn't something which would actually happen in the wild.

Answer 4 · 2019-12-04T11:35:43.000Z

When I get a signature I need to know the message that was signed in order to verify the signature. Is there a way to get this message?

Until now the only way I found that works is by using static "file://" concatenated with nonce.

Answer 5 · 2019-12-04T15:42:04.000Z

Ah, I see what you're asking.
Then yes, since you are running it from your drive, and also not putting in the optional parameter to specify what to be signed, then authenticate() is using the origin which in your case is the filepath.

You can pass in something else to sign instead: https://github.com/GetScatter/scatter-js/blob/master/mock-sites/eosjs/index.html#L219

Answer 6 · 2019-12-04T15:48:05.000Z

Thanks, I've tried this before but without success. I'll try again.

…

On Wed, 4 Dec 2019, 10:42 Nathan James, ***@***.***> wrote: Ah, I see what you're asking. Then yes, since you are running it from your drive, and also not putting in the optional parameter to specify what to be signed, then authenticate() is using the origin which in your case is the filepath. You can pass in something else to sign instead: https://github.com/GetScatter/scatter-js/blob/master/mock-sites/eosjs/index.html#L219 — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#145?email_source=notifications&email_token=ABBSADXKKHCSMHHNJE2TUATQW7FU3A5CNFSM4JKGFNBKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEF5OGOA#issuecomment-561701688>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABBSADV4TRMJ3M2VZRNM2TDQW7FU3ANCNFSM4JKGFNBA> .