Skip to content

feat: make getNonce optional in AuthenticationAdapter#2674

Open
2wheeh wants to merge 4 commits into
rainbow-me:mainfrom
2wheeh:@2wheeh/optional-getnonce
Open

feat: make getNonce optional in AuthenticationAdapter#2674
2wheeh wants to merge 4 commits into
rainbow-me:mainfrom
2wheeh:@2wheeh/optional-getnonce

Conversation

@2wheeh
Copy link
Copy Markdown
Contributor

@2wheeh 2wheeh commented May 7, 2026

Description

Follow-up to #2633.

... nonces must come from the server. A client-generated nonce provides no replay protection because an attacker can reuse the signed message with the same nonce.
SIWE security considerations

#2633 enabled server-side SIWE message generation, but the adapter still required getNonce. dApps following that pattern end up shipping dead boilerplate — a no-op /api/nonce endpoint or getNonce: async () => 'nonce' — just to satisfy the type, with no real-world signal flowing through it.

This PR makes getNonce optional. When omitted, the client-side nonce pre-fetch is skipped and createMessage receives only { address, chainId }.

API

AuthenticationAdapter becomes a discriminated union — fully backwards compatible:

  • With getNoncecreateMessage({ nonce, address, chainId }). Unchanged.
  • Without getNoncecreateMessage({ address, chainId }). Pre-fetch skipped; button enabled immediately.

@vercel
Copy link
Copy Markdown

vercel Bot commented May 7, 2026

@2wheeh is attempting to deploy a commit to the rainbowdotme Team on Vercel.

A member of the Team first needs to authorize it.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 7, 2026

🦋 Changeset detected

Latest commit: df43ae1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages
Name Type
@rainbow-me/rainbowkit Patch
example Patch
@rainbow-me/rainbow-button Patch
rainbowkit-next-app Patch
site Patch
with-create-react-app Patch
with-next-app-i18n Patch
with-next-app Patch
with-next-custom-button Patch
with-next-mint-nft Patch
with-next-siwe-iron-session Patch
with-next-siwe-next-auth Patch
with-next-wallet-button Patch
with-next Patch
with-react-router Patch
with-remix Patch
with-vite Patch
with-next-rainbow-button Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@2wheeh 2wheeh force-pushed the @2wheeh/optional-getnonce branch from 9162c76 to df43ae1 Compare May 7, 2026 05:57
@2wheeh 2wheeh marked this pull request as ready for review May 7, 2026 06:08
@2wheeh 2wheeh requested a review from a team as a code owner May 7, 2026 06:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant