Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEP-0010: Clarify the first manage data operation is the operation containing the client account, home domain, etc #754

Merged
merged 2 commits into from
Oct 29, 2020
Merged

SEP-0010: Clarify the first manage data operation is the operation containing the client account, home domain, etc #754

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f7dd591
SEP-0010: Clarify the
leighmcculloch Oct 23, 2020
2efd3b9
Make clear all operations are manage data operations
leighmcculloch Oct 26, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ecosystem/sep-0010.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ Title: Stellar Web Authentication
Author: Sergey Nebolsin <@nebolsin>, Tom Quisel <[email protected]>, Leigh McCulloch <@leighmcculloch>, Jake Urban <[email protected]>
Status: Active
Created: 2018-07-31
Updated: 2020-10-07
Version 2.1.0
Updated: 2020-10-23
Version 2.1.1
```

## Simple Summary
Expand All @@ -23,7 +23,7 @@ The authentication flow is as follows:
1. The client obtains a unique [`challenge`](#challenge), which is represented as specially formed Stellar transaction
1. The client verifies that the transaction has an invalid sequence number 0. This is extremely important to ensure the transaction isn't malicious.
1. The client verifies that the transaction is signed by the `SIGNING_KEY` specified by the requested service's [SEP-1 stellar.toml](sep-0001.md).
1. The client verifies that the transaction has a single Manage Data operation with its source account set to the user's account and value set to a nonce value. The client ignores the home domain included.
1. The client verifies that the transaction's first Manage Data operation has its source account set to the user's account and value set to a nonce value. The client ignores the home domain included.
leighmcculloch marked this conversation as resolved.
Show resolved Hide resolved
1. The client verifies that if the transaction has other Manage Data operations they all have their source accounts set to the the server's account.
1. The client signs the transaction using the secret key(s) of signers for the user's Stellar account
1. The client submits the signed challenge back to the server using [`token`](#token) endpoint
Expand Down