jns.eth

Problem solver @thirdweb Prev: @twitch, @bebo_official. Mostly professional. @sabasedighi is my better half. Opinions always my own.

[jns.eth @jnsdls]

In Japan

[Matt Gallagher @MattP1Gallagher]

Where does Yuki Tsunoda qualify for the Japanese GP?

[jns.eth @jnsdls]

@theo Yep, dealt with this before

[jns.eth @jnsdls]

@yangyou … in the US I assume?

[jns.eth @jnsdls]

@typeofalex @krall12 @sunneydev @myothercoolname @theo If you feel this strongly about the docs you can go and propose a change, they are open source for a reason.

Could the docs be more nuanced? Of course. Should you auth at the resource level? Also of course.

[jns.eth @jnsdls]

@typeofalex @krall12 @sunneydev @myothercoolname @theo This actually has nothing to do with next at all and is just… basic.

What follows from it however is that middleware can be used to shortcut clear NEGATIVE (expected auth token to exist, but it doesn’t exist) cases in order to avoid downstream work, but for auth that’s all.

[jns.eth @jnsdls]

@typeofalex @krall12 @sunneydev @myothercoolname @theo I’m saying that any downstream resource has to verify auth again. You cannot just auth once and then absolve yourself from there on out. The place where sensitive data is read or any data is written is the place that HAS to do auth.

[jns.eth @jnsdls]

@krall12 @sunneydev @myothercoolname @theo @typeofalex And if you don’t do that, well then you’re saying anybody can (without any auth) just access any downstream resource, which by definition would be insecure. (All they would need for this is to discover which resources you call in your app, which generally is trivial.)

[jns.eth @jnsdls]

@krall12 @sunneydev @myothercoolname @theo @typeofalex Say for example you protect some admin page with middleware. Say that calls another resource that modifies (or even reads) DB state. That other resource HAS to verify the auth again. (Auth token may literally have just expired in the meantime for a basic reason.)

[jns.eth @jnsdls]

@typeofalex @krall12 @sunneydev @myothercoolname @theo If the only thing you’re accessing after middleware is a static page then middleware might be fine.

However if the page after middleware DOES anything on behalf of the auth’d user then that HAS to be auth’d again.

[jns.eth @jnsdls]

@krall12 @sunneydev @myothercoolname @theo @typeofalex It is objectively insecure to not check auth as part of later calls that you make after the initial routing is complete. Middleware in next JS is not express, never has been.

You can (and should) shortcut un-authed requests in middleware, but that’s it.

[jns.eth @jnsdls]

@krall12 @sunneydev @myothercoolname @theo @typeofalex If they are affected they had built their sites in an insecure way to begin with. Locating the source of truth for auth in middleware instead of with the APIs that need to know about the auth state would have always been insecure, regardless of this CVE.

[jns.eth @jnsdls]

@theo The correct take

[jns.eth @jnsdls]

@growthepie_eth @KingOfDestinyIG @erc4337 @LayerZero_Core @thirdweb @reservoir0x Appreciate it :) lowercase gotta stick together

[jns.eth @jnsdls]

@growthepie_eth @KingOfDestinyIG @erc4337 @LayerZero_Core @thirdweb @reservoir0x thirdweb, all lower case please 🥲

[jns.eth @jnsdls]

@SourcifyEth Source code should be self-verifying as long as the deployer uploads the compilation metadata to ipfs as defined in the spec

[jns.eth @jnsdls]

@FurqanR @Highmonkey888 @thirdweb @jake_loo @jake_loo

[jns.eth @jnsdls]

@DestinerX @thirdweb

<chain_id>.rpc.thirdweb.com for 2500+ chains, enjoy

[jns.eth @jnsdls]

@atifkhan31 @FurqanR Yep

[jns.eth @jnsdls]

@atifkhan31 @FurqanR Goal is to make it so the conference comes to you

[jns.eth @jnsdls]

@atifkhan31 @FurqanR Haven’t gone to a single conference that didn’t literally fall into my lap ¯\_(ツ)_/¯