Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add additional signed data checks #168

Closed
wants to merge 4 commits into from
Closed

Conversation

aquarat
Copy link
Contributor

@aquarat aquarat commented Dec 13, 2023

Closes #162

This PR expands the existing signed data freshness check to confirm that the sample we've received is newer than what we already have (if we have something to compare against).

It also checks that the received sample is not older than an hour.

I'm not sure if this satisfies the issue? 🤷

@aquarat aquarat requested a review from Siegrift December 14, 2023 09:40
@aquarat aquarat self-assigned this Dec 14, 2023
@aquarat aquarat marked this pull request as ready for review December 14, 2023 10:00
Copy link
Collaborator

@Siegrift Siegrift left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I mentioned in the comment, I think fixing the confusing case mentioned in the issue is not worth it. It won't happen in practice and I only reproduced it because I saved some very old signed data response in my Postman.

WDYT?

continue;
}

if (Date.now() / 1000 - requestTimestamp > 60 * 60) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mhh, what is wrong with >1h old signed data?

logger.debug('Not storing signed data because signed data with the same timestamp already exists.', {
const goReadDb = await go(async () => get(signedData.airnode, signedData.templateId));

if (goReadDb.data && requestTimestamp <= Number.parseInt(goReadDb.data.timestamp, 10)) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We want to store even older data we have because it might be served by other (delayed) endpoint. To address the issue we would need to check whether the signed data will be pruned, but checking that is more complex than I initially thought (and probably not worth relative to the added benefit).

@aquarat
Copy link
Contributor Author

aquarat commented Dec 20, 2023

As I mentioned in the comment, I think fixing the confusing case mentioned in the issue is not worth it. It won't happen in practice and I only reproduced it because I saved some very old signed data response in my Postman.

WDYT?

Sounds good to me, we can always come back to it. In practice we shouldn't be pushing very old signed data to the chain anyway (ultimately that's where the data will be going via Airseeker).

@aquarat aquarat closed this Dec 20, 2023
@Siegrift Siegrift deleted the 162-do-not-store-bad-data branch January 9, 2024 08:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Do not store unusable data in Signed API
2 participants