Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check for clock skew on login #1236

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 7 additions & 0 deletions ios/edge/Info.plist
Expand Up @@ -68,6 +68,13 @@
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>worldtimeapi.org</key>
<dict>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe this will work in production apps as Apple is strict about https

<true/>
</dict>
<key>localhost</key>
<dict>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
Expand Down
1 change: 1 addition & 0 deletions src/constants/IconConstants.js
Expand Up @@ -22,6 +22,7 @@ export const CUSTOM_FEES_ICON = 'wpexplorer'
export const EXCHANGE_ICON = 'exchange'
export const QUESTION_ICON = 'question'
export const FA_MONEY_ICON = 'money'
export const CLOCK = 'clock-o'

// Feather
export const FEATHER_ICONS = 'featherIcons'
Expand Down
5 changes: 4 additions & 1 deletion src/locales/en_US.js
Expand Up @@ -491,7 +491,10 @@ const strings = {
alert_deep_link_no_wallet: 'No wallets exist that support %1$s. You can create a wallet for %2$s by tapping + on the Wallet List screen.',
load_plugin: 'Load Plugin',
plugin_url: 'Plugin URL',
choose_your_wallet: 'Choose Your Wallet'
choose_your_wallet: 'Choose Your Wallet',
clock_skew_modal_title: 'Clock skew detected',
clock_skew_modal_message:
'Your device clock is off by more than 30 seconds from the correct time. This can cause issues logging into your account. Please correct the time skew on your device.'
}

// export default strings
Expand Down
4 changes: 3 additions & 1 deletion src/locales/strings/enUS.json
Expand Up @@ -455,5 +455,7 @@
"alert_deep_link_no_wallet": "No wallets exist that support %1$s. You can create a wallet for %2$s by tapping + on the Wallet List screen.",
"load_plugin": "Load Plugin",
"plugin_url": "Plugin URL",
"choose_your_wallet": "Choose Your Wallet"
"choose_your_wallet": "Choose Your Wallet",
"clock_skew_modal_title": "Clock skew detected",
"clock_skew_modal_message": "Your device clock is off by more than 30 seconds from the correct time. This can cause issues logging into your account. Please correct the time skew on your device."
}
27 changes: 27 additions & 0 deletions src/modules/Login/action.js
@@ -1,6 +1,8 @@
// @flow

import { createSimpleConfirmModal, showModal } from 'edge-components'
import type { EdgeAccount } from 'edge-core-js'
import React from 'react'
import { Platform } from 'react-native'
import Locale from 'react-native-locale'
import PushNotification from 'react-native-push-notification'
Expand Down Expand Up @@ -29,6 +31,7 @@ import {
import * as CORE_SELECTORS from '../Core/selectors'
import { updateWalletsRequest } from '../Core/Wallets/action.js'
import type { Dispatch, GetState } from '../ReduxTypes'
import { Icon } from '../UI/components/Icon/Icon.ui.js'

const localeInfo = Locale.constants() // should likely be moved to login system and inserted into Redux

Expand Down Expand Up @@ -180,6 +183,30 @@ export const initializeAccount = (account: EdgeAccount, touchIdInfo: Object) =>
accountInitObject.pinMode = coreFinal.pinMode
accountInitObject.otpMode = coreFinal.otpMode

// Check clock skew against atomic time
try {
const remoteTime = await fetch('http://worldtimeapi.org/api/timezone/Etc/GMT')
const body = await remoteTime.json()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not put a blocking network call in initAccount as this can slow down login times for users. This should run in the background and throw a modal once complete.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, we should probably have this at app startup time instead of initAccount as the user might not be able to login at all. This would entail moving almost the entire PR to the edge-login-ui repo which is a good idea so SDK partners get it as well.

const remoteSecondsSinceEpoch = body.unixtime

const localSecondsSinceEpoch = Date.now() / 1000

const clockSkew = Math.abs(localSecondsSinceEpoch - remoteSecondsSinceEpoch)

if (clockSkew > 30) {
const modal = createSimpleConfirmModal({
title: s.strings.clock_skew_modal_title,
message: s.strings.clock_skew_modal_message,
icon: <Icon type={Constants.FONT_AWESOME} name={Constants.CLOCK} size={35} />,
buttonText: s.strings.string_ok
})

showModal(modal)
}
} catch (e) {
console.log('Time check error: ', e)
}

dispatch({
type: 'ACCOUNT_INIT_COMPLETE',
data: { ...accountInitObject }
Expand Down