Skip to main content

validate_message

pylon_auth::siwe

Function validate_message 

Source 
pub fn validate_message(
    nonces: &NonceStore,
    message: &SiweMessage,
    expected_domain: &str,
) -> Result<(), SiweError>
Expand description

Validate the non-cryptographic parts of a SIWE message: domain, nonce, expiration, not-before. Use verify to also check the signature.

Wave-5 codex P1 fix: this function now PEEKS the nonce instead of consuming it. The caller (typically verify) must call NonceStore::take separately AFTER full success to actually consume. Otherwise an attacker who knows the victim’s pending nonce can burn it by submitting any-old garbage to the verify endpoint, DoSing the legit user’s sign-in.