Skip to content

fix(nextjs-x402): enforce real x402Serve payment verification and reject arbitrary headers (fixes #81) - #84

Merged
Eras256 merged 1 commit into
nirium-protocol:mainfrom
s6pa1rta3n-lab:fix-issue
Aug 29, 2026
Merged

fix(nextjs-x402): enforce real x402Serve payment verification and reject arbitrary headers (fixes #81)#84
Eras256 merged 1 commit into
nirium-protocol:mainfrom
s6pa1rta3n-lab:fix-issue

Conversation

@s6pa1rta3n-lab

@s6pa1rta3n-lab s6pa1rta3n-lab commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

  • Enforced Real x402 Verification: Replaced the naive presence check in examples/nextjs-x402/app/lib/nirium-x402-seller.ts with x402Serve() middleware from the Nirium SDK, ensuring payment proofs undergo cryptographic validation and settlement via the x402 facilitator.
  • Fail-Closed Misconfiguration Handling: Added validation so that routes fail closed with proper 500 error when payTo or facilitator credentials/endpoints are misconfigured or missing.
  • Updated Protocol Header Standards: Added full support for the standard protocol headers (PAYMENT-SIGNATURE / payment-signature) as primary headers while retaining backwards-compatible routing for X-PAYMENT to ensure it is strictly verified.
  • Added Automated Smoke Test Suite: Created examples/nextjs-x402/test/smoke.test.js covering misconfiguration handling, failure modes, refusal of arbitrary/bogus X-PAYMENT and PAYMENT-SIGNATURE tokens, and direct handler execution.
  • Documentation & UI Updates: Updated README.md and page.tsx in examples/nextjs-x402 to reflect facilitator requirements and the modern PAYMENT-SIGNATURE protocol header.

Stipulations Compliance Checklist

  • Replaced withNiriumX402 with real x402Serve()/facilitator-backed path ensuring true cryptographic verification.
  • Route fails closed if no valid facilitator or seller credentials are configured.
  • Added automated smoke tests asserting arbitrary/bogus X-PAYMENT and PAYMENT-SIGNATURE headers are rejected without invoking the paid handler.
  • Updated header handling and documentation to standardize on PAYMENT-SIGNATURE / payment-signature.
  • Verified npm test, npm run typecheck, and npm run build pass without error.
  • No cryptographic primitives or assertions were mocked to bypass checks.

Fixes #81

Payout Routing

  • EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
  • Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC

@Eras256
Eras256 marked this pull request as ready for review August 29, 2026 23:10
@Eras256
Eras256 merged commit 3023028 into nirium-protocol:main Aug 29, 2026
@Eras256 Eras256 mentioned this pull request Aug 29, 2026
Closed
@Eras256 Eras256 mentioned this pull request Oct 4, 2026
Merged
M0nsxx pushed a commit to M0nsxx/nirium-sdk that referenced this pull request Oct 23, 2026
@Eras256 @claude
fix(nextjs-x402): regenerate package-lock to match package.json
27cbc11 
nirium-protocol#84 switched nirium from file:../../packages/sdk to ^0.10.1 in
package.json but kept the old lock, where nirium is still a link to the
local SDK. npm ci has failed in this example since then.

Regenerated against the current package.json (nirium resolves to 0.10.2)
and bumped fast-uri to 3.1.8 in the same pass. npm ci, npm test (7/7),
typecheck and next build all pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Next.js x402 example grants access when any X-PAYMENT header is present

2 participants

@s6pa1rta3n-lab @Eras256