From 2a373a243f97044ec79983506c56fdcc292e5885 Mon Sep 17 00:00:00 2001 From: Luis Fernando Molina Date: Wed, 22 Sep 2021 14:34:37 +0200 Subject: [PATCH] Desktop & Network validating Signature Hash --- .../Network/NT/Modules/WebSocketsInterface.js | 17 +++++++++++++++-- Projects/Network/SA/Modules/WebSocketsClient.js | 12 +++++++++++- 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/Projects/Network/NT/Modules/WebSocketsInterface.js b/Projects/Network/NT/Modules/WebSocketsInterface.js index 72d0bb8c3..1e4c548dc 100644 --- a/Projects/Network/NT/Modules/WebSocketsInterface.js +++ b/Projects/Network/NT/Modules/WebSocketsInterface.js @@ -304,12 +304,25 @@ exports.newNetworkModulesWebSocketsInterface = function newNetworkModulesWebSock caller.socket.send(JSON.stringify(response)) return } + let signedMessage = JSON.parse(signature.message) + /* + We will verify that the signature belongs to the signature.message. + To do this we will hash the signature.message and see if we get + the same hash of the signature. + */ + let hash = web3.eth.accounts.hashMessage(signature.message) + if (hash !== signature.messageHash) { + let response = { + result: 'Error', + message: 'signature.message Hashed Does Not Match signature.messageHash.' + } + caller.socket.send(JSON.stringify(response)) + return + } /* The user profile based on the blockchain account, based on the signature, it is our witness user profile, to validate the caller. */ - let signedMessage = JSON.parse(signature.message) - if (signedMessage.callerProfileHandle !== witnessUserProfile.userProfileHandle) { let response = { result: 'Error', diff --git a/Projects/Network/SA/Modules/WebSocketsClient.js b/Projects/Network/SA/Modules/WebSocketsClient.js index 04807076d..3518d86fd 100644 --- a/Projects/Network/SA/Modules/WebSocketsClient.js +++ b/Projects/Network/SA/Modules/WebSocketsClient.js @@ -124,7 +124,17 @@ exports.newNetworkModulesWebSocketsClient = function newNetworkModulesWebSockets } let signedMessage = JSON.parse(signature.message) - + /* + We will verify that the signature belongs to the signature.message. + To do this we will hash the signature.message and see if we get + the same hash of the signature. + */ + let hash = web3.eth.accounts.hashMessage(signature.message) + if (hash !== signature.messageHash) { + console.log('[ERROR] Web Sockets Client -> stepOneResponse -> signature.message Hashed Does Not Match signature.messageHash.') + reject() + return + } /* We will check that the Network Node that responded has the same User Profile Handle that we have on record, otherwise something is wrong and we should not proceed.