security: add domain validation to SIWE authentication examples

[zkasuran]

Summary

Fixes cross-domain replay attack vulnerability in the authenticate-users guide backend examples.

Problem (Issue #1502)

The current backend verification code only checks the cryptographic signature without validating the SIWE message domain:

const valid = await client.verifyMessage({ address, message, signature });

This is insecure. A valid SIWE signature created for evil.com can be submitted to yourapp.com's /auth/verify endpoint and will pass verification, because verifyMessage only validates the cryptographic signature — not whether the message was intended for this domain.

EIP-4361 Requirement

EIP-4361 explicitly requires relying parties to validate the domain field:

"The full SIWE message MUST be checked for conformance... checked against expected values after parsing (e.g., expiration-time, nonce, request-uri, domain etc.)"

Solution

Replace verifyMessage with verifySiweMessage which validates domain, nonce, and expiry:

import { verifySiweMessage } from 'viem/siwe';

const valid = await verifySiweMessage(client, {
  address,
  message,
  signature,
  domain: 'yourapp.com', // Validates message was intended for this domain
});

Changes

• ✅ Updated both backend examples (inline + Express server)
• ✅ Added verifySiweMessage import from viem/siwe
• ✅ Added explicit domain parameter with comment
• ✅ Added security rationale comment in Express example

Impact

Before: Developers following this guide ship authentication endpoints vulnerable to cross-domain replay attacks.

After: Secure authentication that complies with EIP-4361 spec.

Testing

Code follows viem's official API:

• verifySiweMessage documentation

Fixes #1502

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[zkasuran]

Still at 0/2 reviews, so here is where this stands against current master.

The bug is live. Both backend examples in docs/base-account/guides/authenticate-users.mdx still call client.verifyMessage({ address, message, signature }) (lines 155 and 213 on master today). That checks the signature and nothing else, so a SIWE message a user signed for some other site verifies against any /auth/verify built from this page. That is the cross-domain replay in #1502.

The patch still applies as written. Master has 202 files changed since this branch's merge base and authenticate-users.mdx is not one of them.

On the ERC-6492 line earlier in the page, verifySiweMessage keeps that behaviour. It parses the message, runs validateSiweMessage over domain, nonce and time, then calls verifyHash, which is the same universal signature validator path verifyMessage goes through. Base Account signatures from an undeployed contract still verify.

One note on merge order: #1560 was branched off this commit, so its diff contains this change. Merge this one first and #1560 comes down to its own three files, or merge #1560 alone and close this one as included.