fix(auth): fail closed on unparseable SIWE Not Before / Expiration by SashaMIT · Pull Request #8875 · thirdweb-dev/js

SashaMIT · 2026-08-08T16:53:25Z

Summary

verifyLoginPayload compared currentDate to new Date(invalid_before) / new Date(expiration_time).
In JavaScript, comparisons with Invalid Date are always false, so unparseable times skipped Not Before / Expiration checks while signature verification still ran.
Fail closed when Number.isNaN(date.getTime()).

Test plan

pnpm exec vitest run src/auth/core/verify-login-payload.test.ts (5 passed), including unparseable never / empty string cases

Made with Cursor

PR-Codex overview

This PR focuses on enhancing the validation of SIWE login payloads by rejecting those with unparseable Not Before or Expiration Time values, ensuring stricter adherence to time-bound checks.

Detailed summary

Added validation for invalid_before and expiration_time in verify-login-payload.ts.
Introduced error messages for invalid timestamps.
Created tests to verify failure cases for unparseable expiration_time and invalid_before in verify-login-payload.test.ts.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Summary by CodeRabbit

Bug Fixes
- Login verification now rejects payloads with invalid or unparseable expiration and start-time values.
- Valid timestamps continue to be checked against expiration and not-before rules.
Tests
- Added coverage confirming clear validation errors are returned for malformed time values.

Invalid Date comparisons are always false in JS, so unparseable invalid_before / expiration_time previously skipped time bounds while signature verification still ran. Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

changeset-bot · 2026-08-08T16:53:30Z

🦋 Changeset detected

Latest commit: 0e5b6b3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
thirdweb	Patch
@thirdweb-dev/nebula	Patch
@thirdweb-dev/wagmi-adapter	Patch
wagmi-inapp	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-08-08T16:53:34Z

@SashaMIT is attempting to deploy a commit to the thirdweb Team on Vercel.

A member of the Team first needs to authorize it.

coderabbitai · 2026-08-08T16:53:48Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 43593662-2891-410f-acbe-dc4cdcd64bf4

📥 Commits

Reviewing files that changed from the base of the PR and between 518f7e9 and 0e5b6b3.

📒 Files selected for processing (1)

packages/thirdweb/src/auth/core/verify-login-payload.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

packages/thirdweb/src/auth/core/verify-login-payload.test.ts

Walkthrough

Login payload verification now rejects unparseable invalid_before and expiration_time values. Tests verify the corresponding validation errors.

Changes

Login payload validation

Layer / File(s)	Summary
Time parsing validation and test coverage `packages/thirdweb/src/auth/core/verify-login-payload.ts`, `packages/thirdweb/src/auth/core/verify-login-payload.test.ts`, `.changeset/siwe-fail-closed-invalid-dates.md`	The verifier rejects invalid `invalid_before` and `expiration_time` values. Tests cover both validation errors. The changeset documents the patch release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 0e5b6

The change rejects unparseable SIWE time bounds instead of allowing them to bypass validation; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main authentication fix for unparseable SIWE time fields.
Description check	✅ Passed	The description explains the bug, the fail-closed fix, and the test plan with passing test results.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

* fix(siwe): reject unparseable expirationTime and notBefore Invalid Date values from parseSiweMessage (e.g. Expiration Time: never) are truthy, so comparisons like `time >= expirationTime` are always false and lifetime / nbf checks were skipped. Fail closed when either field is present but not a real date (sibling of thirdweb-dev/js#8875 / supabase/auth#2688). * fix(siwe): require EIP-4361 date-time strings and reject invalid time Validate raw SIWE timestamps against the RFC 3339 profile before Date coercion, and fail closed when the caller-supplied time is invalid so lifetime comparisons cannot be skipped. * fix(siwe): inline date validation --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com>

* feat: add block header watcher (#4999) * fix: complete block header watcher integration (#5001) * chore: version package (#5000) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(tempo): bind encrypted deposits to sender (#5002) * fix(tempo): bind encrypted deposits to sender Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * ci: test sender-bound zone deposits * ci: align Tempo and Zone fixtures * test(tempo): routed T10 fixtures through encrypted deposits * chore: logged local Zone provisioning stall * chore: ignored unpatched extract-zip advisory * fix(tempo): defaulted encrypted deposit sender * ci: skipped Wagmi verification * chore: remove friction log --------- Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Steven Truong <struong@users.noreply.github.com> Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * chore: version package (#5003) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(siwe): reject unparseable expirationTime and notBefore (#4990) * fix(siwe): reject unparseable expirationTime and notBefore Invalid Date values from parseSiweMessage (e.g. Expiration Time: never) are truthy, so comparisons like `time >= expirationTime` are always false and lifetime / nbf checks were skipped. Fail closed when either field is present but not a real date (sibling of thirdweb-dev/js#8875 / supabase/auth#2688). * fix(siwe): require EIP-4361 date-time strings and reject invalid time Validate raw SIWE timestamps against the RFC 3339 profile before Date coercion, and fail closed when the caller-supplied time is invalid so lifetime comparisons cannot be skipped. * fix(siwe): inline date validation --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * fix: asset discovery in `simulateCalls` (#4997) * fix(simulateCalls): discover assets from simulated logs * refactor(simulateCalls): align asset discovery with repo conventions * fix(simulateCalls): pin both asset-tracing passes to one base block * test(simulateCalls): skip asset tracing on the pinned Anvil * chore: update accessListHints comment * fix(simulateCalls): preserve block tags and request errors * fix(simulateCalls): harden asset trace discovery * test: use reth for mainnet forks * test(simulateCalls): run asset tracing against reth * fix(simulateCalls): align asset trace simulations * fix(simulateCalls): stabilize asset tracing * chore: add static call source * fix(simulateCalls): simplify asset tracing * fix(simulateCalls): isolate asset balance probes * fix(simulateCalls): align asset probe callers * fix(simulateCalls): preserve pending block tag * fix(simulateCalls): normalize transfer topics * refactor(simulateCalls): remove redundant asset deduplication * test(simulateCalls): cover asset tracing edge cases * docs(simulateCalls): describe pending asset tracing --------- Co-authored-by: jxom <7336481+jxom@users.noreply.github.com> * fix: update nanoid security override * fix: increase package size limits * ci: remove docs deployment --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: struong <steven@tempo.xyz> Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> Co-authored-by: Steven Truong <struong@users.noreply.github.com> Co-authored-by: Sash <sash@ela.city> Co-authored-by: Ghadi <92851745+Ghadi8@users.noreply.github.com>

SashaMIT requested review from a team as code owners August 8, 2026 16:53

github-actions Bot added packages SDK Involves changes to the thirdweb SDK labels Aug 8, 2026

SashaMIT mentioned this pull request Aug 8, 2026

fix(siwe): reject unparseable expirationTime and notBefore wevm/viem#4990

Merged

2 tasks

0xFirekeeper added 3 commits August 14, 2026 01:23

Merge remote-tracking branch 'origin/main' into tmp-8875

8678860

Add changeset for SIWE fail-closed fix

518f7e9

Format verify-login-payload files

0e5b6b3

0xFirekeeper merged commit f411769 into thirdweb-dev:main Aug 13, 2026
14 of 20 checks passed

0xFirekeeper mentioned this pull request Aug 13, 2026

Version Packages #8888

Merged

This was referenced Aug 14, 2026

DID token validate fail-opens on non-numeric ext/nbf/iat magiclabs/magic-admin-js#155

Open

fix: reject non-finite DID token iat/ext/nbf magiclabs/magic-admin-js#156

Open

Navigation Menu

Uh oh!

fix(auth): fail closed on unparseable SIWE Not Before / Expiration - #8875

fix(auth): fail closed on unparseable SIWE Not Before / Expiration#8875
0xFirekeeper merged 4 commits into
thirdweb-dev:mainfrom
SashaMIT:fix/siwe-reject-invalid-date-bounds

SashaMIT commented Aug 8, 2026 •

edited by pr-codex Bot

Loading

Uh oh!

changeset-bot Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 8, 2026

Uh oh!

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

SashaMIT commented Aug 8, 2026 • edited by pr-codex Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

PR-Codex overview

Detailed summary

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel Bot commented Aug 8, 2026

Uh oh!

coderabbitai Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SashaMIT commented Aug 8, 2026 •

edited by pr-codex Bot

Loading

changeset-bot Bot commented Aug 8, 2026 •

edited

Loading

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading