q9f / ethereum-on-rails Goto Github PK

When signup, is it possible to send eth addresses other than my own from the front end to the back end?

I think that since the app/javascript/packs/users_new.js puts your address into the form on the front side, the backend side cannot determine if this is really the address of the user who submitted the post.

Hello, thanks for the awesome repo, it will be useful for many users.

I guess this time conditional in SessionsController is always true:

request_time = Time.at(request_time.to_f / 1000.0)
expiry_time = request_time + 300

# also make sure the parsed request_time is sane
 # (not nil, not 0, not off by orders of magnitude)
sane_checkpoint = Time.parse "2021-01-01 00:00:00 UTC"
if request_time and request_time > sane_checkpoint and request_time < expiry_time

Because when you sum expiry_time + 300, it always be big then request_time, maybe we need to change request time to Time.now, like:

request_time and request_time > sane_checkpoint and Time.zone.now < expiry_time

currently, we are signing a random nonce

should sign nonce from database to prevent signature spoofing

ref se3000/ruby-eth#57