Wallet-Signature Authentication Middleware (NextAuth Compatible)

[Luluameh]

• Labels: backend, security, auth, stellar

Description

We must protect backend mutations (like updating expert profiles or withdrawing/refunding) by ensuring requests are signed by the private key of the Stellar account claiming ownership.

Technical Scope & Steps

1. Create an Express middleware that validates signed payloads.
2. Expect headers containing: X-Stellar-Public-Key, X-Signature, and X-Auth-Nonce (or timestamp).
3. Verify that the signature is valid for the public key using @stellar/stellar-sdk (specifically using Keypair.fromPublicKey().verify(data, signature)).
4. Reject requests older than 5 minutes to prevent replay attacks.

Acceptance Criteria

• Properly signed requests are authorized and pass through the middleware.
• Modifying the payload, public key, or signature triggers a strict `401 Unauthorized "response."
• Replaying a signature past the expiration window results in rejection.