Skip to content

"Web3 Wallet" Auth message construction invalid (breaks recognition) #2323

@caveman-eth

Description

@caveman-eth

Bug report

Describe the bug

Supabase "Web3 Wallet" Authentication provider constructs and invalid EIP-4361 message, it does not include a nonce, making it out of spec and not recognized by wallets like MetaMask.

To Reproduce

Steps to reproduce the behavior:

  1. Enable "Web3 Wallet" under supabase -> Authentication -> Sign in / Providers
  2. Setup the login flow / button on your supabase app
  3. Try to sign in - the message will not have a nonce
  4. See MetaMask prompt saying "Signature request" instead of "Sign in request" - and all validation missing.

Expected behavior

Include a nonce as per the official EIP-4361 spec so the message is valid and recognized.

Screenshots

Official SIWE Validator tool (https://docs.siwe.xyz/validator/)

Image

MetaMask message recognition failure (Supabase left - correct format right)

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions