stellar-SEP-10

An Express service implementing the Stellar SEP-10 web-authentication handshake: it issues a signed challenge transaction and, once the client returns it signed, verifies it and issues a JWT.

hijal/stellar-SEP-10@ 6b139ff ↗

Problem

Authenticate a Stellar account holder to a web service by proving control of their key, following the SEP-10 standard.

Built with

Node.js
Express
stellar-sdk
JSON Web Tokens

Architecture

SEP-10 handshake

Inferred

GET challenge Server builds a transaction
Client signature Account holder signs it
POST challenge Server verifies signatures
Session JWT Issued after verification

routes/sep10/index.js services/sep10/auth.service.js

SEP-10 challenge/response

Inferred

The two endpoints implement the SEP-10 handshake as specified by the Stellar protocol: GET returns a challenge transaction, POST accepts the signed transaction and returns a session token.

routes/sep10/index.js services/sep10/auth.service.js

Evidence

GET /sep10/auth builds a challenge transaction with stellar-sdk Utils.buildChallengeTx using the server signing keypair, the client account, the home and web-auth domains, a 5-minute timeout, the network passphrase, and a random memo id.

Verified

services/sep10/auth.service.js:8-36 controllers/sep10/challenge.js:1-29

POST /sep10/auth verifies the signed challenge with Utils.readChallengeTx, then verifyChallengeTxThreshold against the account's med_threshold and signers loaded from Horizon, falling back to verifyChallengeTxSigners when the account is not found on the network.

Verified

services/sep10/auth.service.js:38-96

After successful verification the service issues a JWT bound to the client account id, transaction and memo.

Verified

controllers/sep10/getToken.js:1-26

The server signing keypair is loaded via Keypair.fromSecret from config and the Horizon Server is constructed from a configured URL.

Verified

services/sep10/auth.service.js:1-7

routes/sep24 and services/index.js are empty placeholder files, and the config keys are misspelled SINGING_SECRET_KEY / SINGING_PUBLIC_KEY.

Verified

routes/sep24/index.js config/config.js

Contribution

Sole developer

Owner-confirmed sole work

Owner-confirmed: sole, original work using the stellar-sdk Utils helpers rather than a copied reference implementation. Express service implementing Stellar SEP-10 web authentication end-to-end (challenge, verification against Horizon signers/thresholds, JWT issuance).