From 5f8b069f5d93cc786c174e9a8e605146d00073b7 Mon Sep 17 00:00:00 2001 From: fiatjaf Date: Fri, 5 Sep 2025 11:06:17 -0300 Subject: [PATCH] khatru: nip86 "u" tag checking normalization fix. --- khatru/nip86.go | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/khatru/nip86.go b/khatru/nip86.go index 25d88bd..c2a2540 100644 --- a/khatru/nip86.go +++ b/khatru/nip86.go @@ -86,13 +86,25 @@ func (rl *Relay) HandleNIP86(w http.ResponseWriter, r *http.Request) { goto respond } - if uTag := evt.Tags.Find("u"); uTag == nil || rl.getBaseURL(r) != uTag[1] { - resp.Error = fmt.Sprintf("invalid 'u' tag, expected '%s', got '%s'", rl.getBaseURL(r), uTag[1]) + uTag := evt.Tags.Find("u") + if uTag == nil { + resp.Error = "missing \"u\" tag" goto respond - } else if pht := evt.Tags.FindWithValue("payload", hex.EncodeToString(payloadHash[:])); pht == nil { + } + + expected := nostr.NormalizeURL(rl.getBaseURL(r)) + got := nostr.NormalizeURL(uTag[1]) + if expected != got { + resp.Error = fmt.Sprintf("invalid \"u\" tag, expected '%s', got '%s'", expected, got) + goto respond + } + + if pht := evt.Tags.FindWithValue("payload", hex.EncodeToString(payloadHash[:])); pht == nil { resp.Error = "invalid auth event payload hash" goto respond - } else if evt.CreatedAt < nostr.Now()-30 { + } + + if evt.CreatedAt < nostr.Now()-30 { resp.Error = "auth event is too old" goto respond }