+/**
+ * GET /auth/stats
+ * Get nonce manager statistics (development only)
+ */
+router.get('/stats', (req, res) => {
+ if (process.env.NODE_ENV === 'production') {
+ return res.status(404).json({
+ success: false,
+ error: { message: 'Not found' },
+ })
+ }
-
+## Authentication Middleware
- {!session && (
+Create `middleware/auth.js` for protecting routes:
- <>
+```javascript
+/**
+ * Middleware to protect routes that require authentication
+ * In a real app, this would verify JWT tokens or sessions
+ */
+function requireAuth(req, res, next) {
+ const authHeader = req.headers.authorization
+
+ if (!authHeader) {
+ return res.status(401).json({
+ success: false,
+ error: {
+ message: 'Authorization header required',
+ },
+ })
+ }
-
+ // In a real implementation, verify JWT token here
+ // For demo purposes, we'll just check for a valid format
+ const token = authHeader.replace('Bearer ', '')
+
+ if (!token || token.length < 10) {
+ return res.status(401).json({
+ success: false,
+ error: {
+ message: 'Invalid authorization token',
+ },
+ })
+ }
- You are not signed in
+ // Add user info to request (would come from JWT payload)
+ req.user = {
+ address: '0x...', // Would be extracted from verified JWT
+ }
-
+ next()
+}
-
+/**
+ * Middleware to validate Ethereum address format
+ */
+function validateAddress(addressField = 'address') {
+ return (req, res, next) => {
+ const address = req.body[addressField] || req.params[addressField]
+
+ if (!address) {
+ return res.status(400).json({
+ success: false,
+ error: {
+ message: `${addressField} is required`,
+ },
+ })
+ }
+
+ // Validate Ethereum address format
+ if (!/^0x[a-fA-F0-9]{40}$/.test(address)) {
+ return res.status(400).json({
+ success: false,
+ error: {
+ message: 'Invalid Ethereum address format',
+ },
+ })
+ }
+
+ next()
+ }
+}
- )}
+module.exports = {
+ requireAuth,
+ validateAddress,
+}
+```
- {session?.user && (
+## Enhanced Verification with Security Checks
- {session.user.image && (
+Create `utils/verification.js`:
-
+ /**
+ * Validate SIWE message structure and content
+ */
+ async validateMessage(siweMessage, additionalChecks = {}) {
+ // Check domain whitelist
+ if (!this.config.allowedDomains.includes(siweMessage.domain)) {
+ throw new Error(`Domain '${siweMessage.domain}' not allowed`)
+ }
+
+ // Check chain ID whitelist
+ if (!this.config.allowedChainIds.includes(siweMessage.chainId)) {
+ throw new Error(`Chain ID '${siweMessage.chainId}' not allowed`)
+ }
+
+ // Check message age
+ const issuedAt = new Date(siweMessage.issuedAt)
+ const now = new Date()
+ const messageAge = now.getTime() - issuedAt.getTime()
+
+ if (messageAge > this.config.maxMessageAge) {
+ throw new Error('Message is too old')
+ }
+
+ if (messageAge < 0) {
+ throw new Error('Message issued in the future')
+ }
+
+ // Check expiration
+ if (siweMessage.expirationTime) {
+ const expirationTime = new Date(siweMessage.expirationTime)
+ if (now > expirationTime) {
+ throw new Error('Message has expired')
+ }
+ }
+
+ // Check not before
+ if (siweMessage.notBefore) {
+ const notBefore = new Date(siweMessage.notBefore)
+ if (now < notBefore) {
+ throw new Error('Message is not yet valid')
+ }
+ }
+
+ // Check statement requirement
+ if (this.config.requireStatement && !siweMessage.statement) {
+ throw new Error('Statement is required')
+ }
+
+ // Additional custom checks
+ if (
+ additionalChecks.requiredAddress &&
+ siweMessage.address.toLowerCase() !==
+ additionalChecks.requiredAddress.toLowerCase()
+ ) {
+ throw new Error('Address mismatch')
+ }
+
+ if (
+ additionalChecks.requiredChainId &&
+ siweMessage.chainId !== additionalChecks.requiredChainId
+ ) {
+ throw new Error('Chain ID mismatch')
+ }
+ }
+}
- )}
+module.exports = SiweVerifier
+```
-
+## Testing the Backend
- Signed in as
+Create a simple test script `test-backend.js`:
-
+```javascript
+const axios = require('axios')
+
+const BASE_URL = 'http://localhost:3001'
+
+async function testBackend() {
+ try {
+ console.log('π§ͺ Testing SIWE Backend API...\n')
+
+ // Test 1: Health check
+ console.log('1. Testing health check...')
+ const health = await axios.get(`${BASE_URL}/health`)
+ console.log('β
Health check:', health.data.status)
+
+ // Test 2: Generate nonce
+ console.log('\n2. Testing nonce generation...')
+ const nonceResponse = await axios.get(`${BASE_URL}/auth/nonce`)
+ const nonce = nonceResponse.data.nonce
+ console.log('β
Nonce generated:', nonce)
+
+ // Test 3: Try invalid verification
+ console.log('\n3. Testing invalid verification...')
+ try {
+ await axios.post(`${BASE_URL}/auth/verify`, {
+ message: 'invalid message',
+ signature: 'invalid signature',
+ })
+ } catch (error) {
+ console.log(
+ 'β
Invalid verification properly rejected:',
+ error.response.status
+ )
+ }
+
+ // Test 4: Get stats (dev only)
+ console.log('\n4. Testing stats endpoint...')
+ const stats = await axios.get(`${BASE_URL}/auth/stats`)
+ console.log('β
Stats:', stats.data.stats)
+
+ console.log('\nπ All tests passed!')
+ } catch (error) {
+ console.error('β Test failed:', error.message)
+ if (error.response) {
+ console.error('Response:', error.response.data)
+ }
+ }
+}
- {session.user.email ?? session.user.name}
+// Run tests
+testBackend()
+```
- {
+# Security settings
+MAX_MESSAGE_AGE=600000
+ALLOWED_DOMAINS=localhost:3000,localhost:3001
+ALLOWED_CHAIN_IDS=1,5,137
- e.preventDefault()
+# Rate limiting
+RATE_LIMIT_WINDOW=900000
+RATE_LIMIT_MAX=100
+```
- disconnect()
+Update `src/server.js` to use environment variables:
- signOut()
+```javascript
+require('dotenv').config()
+
+// Use environment variables for CORS
+app.use(
+ cors({
+ origin: process.env.FRONTEND_URL || 'http://localhost:3000',
+ credentials: true,
+ })
+)
+```
- }}
+## Running the Backend
- >
+Start your backend server:
- Sign out
+```bash
+# Install additional dependencies
+npm install dotenv axios
-
+# Run in development mode
+npm run dev
+```
-
+Test the endpoints:
-