fix(docs): client-side nonce in SIWE example is insecure — add server-side nonce warning
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 58/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- javascript, typescript
- Domain
- authentication, documentation, security
Research direction
Open docs/mini-apps/quickstart/migrate-to-standard-web-app.mdx and locate the “Replace auth and identity” section and its SignIn.tsx example. Review the existing disclaimer and update the example guidance so it clearly explains the replay-protection risk of client-generated nonces or directs readers to a server-issued nonce pattern; done means the warning is prominent and the documentation renders correctly.
Written by the indexing model from the issue text.
Description
Problem
File: docs/mini-apps/quickstart/migrate-to-standard-web-app.mdx
Section: "Replace auth and identity" → SignIn.tsx code example
The example uses generateSiweNonce() on the client side:
const nonce = generateSiweNonce();
A client-generated nonce provides no replay protection. Any attacker who
intercepts a valid SIWE message+signature pair can reuse it, because the
server has no record of which nonces it issued.
Current behavior
The nonce is generated in the browser and never validated server-side.
The existing disclaimer is easy to miss and does not explain why the
current pattern is unsafe.
Expected behavior
Add a prominent warning block above the code example explaining that
client-side nonces offer no replay protection, OR replace the example
with a server-issued nonce pattern.
Impact
Developers following this migration guide verbatim will ship apps with
broken replay protection, exposing users to signature replay attacks.
References
- SIWE spec: https://eips.ethereum.org/EIPS/eip-4361
- Related fix merged in this repo: #1398
- Dominant language
- JavaScript
- Stars
- 337
- Forks
- 798
- Avg merge
- 13h 7m
- Merged PRs (30d)
- 57
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from base/docs
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 1/5 Under an hour Newbie friendliness 95/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
mksglu/context-mode#1200 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
neondatabase/website#5944 ·
-
module: core
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
bigbluebutton/bigbluebutton#25849 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
jaegertracing/jaeger-ui#4506 ·