Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Require cross-origin on sep10 #361

Merged
merged 2 commits into from
Aug 3, 2019
Merged

Require cross-origin on sep10 #361

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bfa3cb7
Add cross-origin headers to sep10
msfeldstein Aug 2, 2019
52febd2
Correct wording for cross-origin message
msfeldstein Aug 2, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 8 additions & 0 deletions ecosystem/sep-0010.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,14 @@ A web service indicates that it supports user authentication via this protocol b
* [`GET <WEB_AUTH_ENDPOINT>`](#challenge): request a challenge (step 1)
* [`POST <WEB_AUTH_ENDPOINT>`](#token): exchange a signed challenge for session JWT (step 2)

## Cross-Origin Headers

Valid CORS headers are necessary to allow web clients from other sites to use the endpoints. The following HTTP header must be set for all authentication endpoints, including error responses.

```
Access-Control-Allow-Origin: *
```

### Challenge

This endpoint must respond with a Stellar transaction signed by the server that has an invalid sequence number (0) and thus cannot be executed on the Stellar network. The client can then sign the transaction using standard Stellar libraries and submit it to [`token`](#token) endpoint to prove that they control their account. This approach is compatible with hardware wallets such as Ledger. The client can also verify the server's signature to be sure the challenge is signed by the `SIGNING_KEY` from the server's [`stellar.toml`](sep-0001.md).
Expand Down