fix(auth): fail closed on unparseable SIWE Not Before / Expiration

packages/thirdweb/src/auth/core/verify-login-payload.test.ts

@@ -146,3 +146,77 @@ describe("verifyLoginPayload", () => {
     expect(verificationResult.valid).toBe(false);
   });
 });
+
+  test("should fail closed on unparseable expiration_time", async () => {
+    const options = {
+      client: TEST_CLIENT,
+      domain: "example.com",
+      login: {
+        nonce: {
+          generate() {
+            return "20cd4ddb-6857-4d36-8e44-9f6e026b8de9";
+          },
+          validate(uuid: string) {
+            return uuid === "20cd4ddb-6857-4d36-8e44-9f6e026b8de9";
+          },
+        },
+        payloadExpirationTimeSeconds: 3600,
+        uri: "https://example.com",
+        version: "1.0",
+      },
+    };
+
+    const generatePayload = generateLoginPayload(options);
+    const payloadToSign = await generatePayload({
+      address: TEST_ACCOUNT_A.address,
+    });
+    payloadToSign.expiration_time = "never";
+
+    const signatureResult = await signLoginPayload({
+      account: TEST_ACCOUNT_A,
+      payload: payloadToSign,
+    });
+
+    const verificationResult = await verifyLoginPayload(options)(signatureResult);
+    expect(verificationResult.valid).toBe(false);
+    if (!verificationResult.valid) {
+      expect(verificationResult.error).toMatch(/invalid Expiration Time/i);
+    }
+  });
+
+  test("should fail closed on unparseable invalid_before", async () => {
+    const options = {
+      client: TEST_CLIENT,
+      domain: "example.com",
+      login: {
+        nonce: {
+          generate() {
+            return "20cd4ddb-6857-4d36-8e44-9f6e026b8de9";
+          },
+          validate(uuid: string) {
+            return uuid === "20cd4ddb-6857-4d36-8e44-9f6e026b8de9";
+          },
+        },
+        payloadExpirationTimeSeconds: 3600,
+        uri: "https://example.com",
+        version: "1.0",
+      },
+    };
+
+    const generatePayload = generateLoginPayload(options);
+    const payloadToSign = await generatePayload({
+      address: TEST_ACCOUNT_A.address,
+    });
+    payloadToSign.invalid_before = "";
+
+    const signatureResult = await signLoginPayload({
+      account: TEST_ACCOUNT_A,
+      payload: payloadToSign,
+    });
+
+    const verificationResult = await verifyLoginPayload(options)(signatureResult);
+    expect(verificationResult.valid).toBe(false);
+    if (!verificationResult.valid) {
+      expect(verificationResult.error).toMatch(/invalid Not Before/i);
+    }
+  });

packages/thirdweb/src/auth/core/verify-login-payload.ts

@@ -100,14 +100,30 @@ export function verifyLoginPayload(options: AuthOptions) {
 
     const currentDate = new Date();
 
-    if (currentDate < new Date(payload.invalid_before)) {
+    // Invalid Date comparisons are always false in JS, so unparseable
+    // invalid_before / expiration_time previously skipped time bounds.
+    const notBefore = new Date(payload.invalid_before);
+    if (Number.isNaN(notBefore.getTime())) {
+      return {
+        error: "Payload has invalid Not Before time",
+        valid: false,
+      };
+    }
+    if (currentDate < notBefore) {
       return {
         error: "Payload is not yet valid",
         valid: false,
       };
     }
 
-    if (currentDate > new Date(payload.expiration_time)) {
+    const expiration = new Date(payload.expiration_time);
+    if (Number.isNaN(expiration.getTime())) {
+      return {
+        error: "Payload has invalid Expiration Time",
+        valid: false,
+      };
+    }
+    if (currentDate > expiration) {
       return {
         error: "Payload has expired",
         valid: false,