Repository navigation
docs(nip98): document that the u-tag host is deliberately not compared - #435
Merged
Merged
Conversation
The in-code comment claimed the u tag check covers host AND path, but the host comparison was removed deliberately in 0448d16 (multi-homed deployment: clearnet, Tor onion, UAT). Replace the comment with the actual tradeoff and its bounds, and state the same in the NIP-98 requirements section of the API documentation so client authors do not rely on host binding. Also spells out the restore path if the phishing tradeoff ever matters: a host ALLOWLIST (several entries), not the old single public_url check. Found by the 2026-11-01 security audit (audit LNVM-014, design note).
v0l
marked this pull request as ready for review
November 2, 2026 10:32
v0l
enabled auto-merge
November 2, 2026 10:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs/comment-only change; found by the same independent audit (2026-11-01).
Problem
The code comment in
lnvps_api_common/src/nip98.rsclaims the NIP-98utag check covers "host and path". It doesn't: the host comparison was removed deliberately in0448d16(this deployment answers on several hostnames — clearnet, Tor onion, UAT — and no single configuredpublic_urlcovers them), but the comment was never updated. Anyone auditing or building on the code is told a control exists that does not.The same section of
API_DOCUMENTATION.md("NIP-98 requirements") is silent on it, so client authors can assume host binding is enforced.Change
API_DOCUMENTATION.mddocuments the same under NIP-98 requirements.public_urlcheck that broke multi-homed clients.No code behavior changes; no tests affected.