Refactor Nostr auth, add login via Nostr (web extension) #188
bumi
Loading…
x
Reference in New Issue
Block a user
No description provided.
Delete Branch "feature/nostr_login"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Changes the Nostr event type we use to be an auth event according to NIP-42, and adds support for logging in via Nostr web extension (e.g. Alby) instead of a password.
This results in a much nicer dialog than (ab)using the default short note event type, since the challenge and site name can be handed over in tags instead of message content. Alby, and I assume other clients, will also show this is an authenticate event and allow to not prompt for confirmation on future events of the same type. So you can allow to log in automatically (i.e. without extra popup window and click), but not to sign any other events automatically.
The Nostr login option will only be shown when a Nostr web extension is installed and enabled. Otherwise it simply stays hidden on the login page.
@bumi Any chance you could give this your seal of approval?
@ -0,0 +23,4 @@def nostr_loginsigned_event = Nostr::Event.new(**nostr_event_from_params)is_valid_sig = signed_event.verify_signatureso because the event signature is correct and because that event contains the session shared_secret I can trust that it's the user with the pubkey to login. 🤔
Yes, when the signature is correct, we know that the owner of the privkey signed it (unless someone stole their key), so we can look up the user via the pubkey from that event/note.
The shared secret is to ensure that no other, evil site tried to obtain an auth event from the user, because the other site cannot know our shared secret.