fix(auth): fail closed on unparseable SIWE Not Before / Expiration

[SashaMIT]

Summary

• verifyLoginPayload compared currentDate to new Date(invalid_before) / new Date(expiration_time).
• In JavaScript, comparisons with Invalid Date are always false, so unparseable times skipped Not Before / Expiration checks while signature verification still ran.
• Fail closed when Number.isNaN(date.getTime()).

Test plan

• pnpm exec vitest run src/auth/core/verify-login-payload.test.ts (5 passed), including unparseable never / empty string cases

Made with Cursor

---

PR-Codex overview

This PR focuses on enhancing the validation of login payloads by adding checks for unparseable date fields, specifically invalid_before and expiration_time, ensuring that the payloads are correctly validated and errors are returned for invalid dates.

Detailed summary

• Added checks for invalid_before and expiration_time to handle unparseable dates.
• Returned specific error messages for invalid Not Before and Expiration Time in the payload.
• Updated tests to verify failure scenarios for unparseable expiration_time and invalid_before.

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

Summary by CodeRabbit

• Bug Fixes

  • Login verification now rejects payloads with invalid or unparseable expiration and start-time values.
  • Valid timestamps continue to be checked against expiration and not-before rules.

• Tests

  • Added coverage confirming clear validation errors are returned for malformed time values.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 46db48c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

@SashaMIT is attempting to deploy a commit to the thirdweb Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a2e4e5b6-aefe-4485-9222-8198b72075a9

📥 Commits

Reviewing files that changed from the base of the PR and between 495d303 and 46db48c.

📒 Files selected for processing (2)

• packages/thirdweb/src/auth/core/verify-login-payload.test.ts
• packages/thirdweb/src/auth/core/verify-login-payload.ts

---

Walkthrough

Login payload verification now rejects unparseable invalid_before and expiration_time values. Tests verify the corresponding validation errors.

Changes

Login payload validation

Layer / File(s)	Summary
Time parsing validation and test coverage packages/thirdweb/src/auth/core/verify-login-payload.ts, packages/thirdweb/src/auth/core/verify-login-payload.test.ts	The verifier rejects invalid invalid_before and expiration_time values. Tests cover both validation errors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: 0xfirekeeper

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the authentication fix for unparseable SIWE time fields.
Description check	✅ Passed	The description explains the defect, the fix, and the tested cases, and includes a clear test plan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}