jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 20:41:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(nips): allow NIP-FA session token on the adapter origin (#8198)

Browse Source 
🤖 NIP-FA limited the adapter session token to the NIP's own endpoints,
which stopped a client from reusing the same login for the adapter
operator's other APIs on that host. This changes the rule to the
adapter's origin (the scheme, host, and port of `{adapter_base}`). The
token still never goes to a relay or any other origin, and the rest of
the security bullet is unchanged.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Alia <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@buzz.block.builderlab.xyz>
This commit is contained in:
Will Pfleger
2026-10-13 17:24:29 -04:00
committed by GitHub
parent 85b7331784
commit 43b88c3a76
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/nips/NIP-FA.md
View File

@@ -171,7 +171,7 @@ WebSocket connections send only `Nostr-Federated-Identity` on the upgrade reques
## Security Considerations
- Clients MUST send `session_token` only to the adapter endpoints defined in this NIP, and MUST NOT send it to a relay or any other origin. A leaked session token lets its holder request assertions for a key they control until the adapter binds the user to a key.
- Clients MUST send `session_token` only to the adapter's origin (the scheme, host, and port of `{adapter_base}`), and MUST NOT send it to a relay or any other origin. A leaked session token lets its holder request assertions for a key they control until the adapter binds the user to a key.
- Clients and adapters MUST NOT log credentials: the `Authorization` and `Nostr-Authorization` header values on every adapter request, including `/v1/session`, and the `handoff_secret` and `session_token` values in the code exchange request and response.
## Privacy