SIWE 2.0 has been released. The interfaces have been updated to allow consistent usage across languages for SIWE message parsing, creation, and verification. Message parsing has been split into its own package, `siwe-parser`, allowing implementers to utilize this functionality standalone without importing larger cryptographic dependencies.
As a result, this update introduces the following breaking changes (hence the major version update) and implements stricter checks from the EIP-4361 specification:
- `validate(…)` was deprecated and renamed to `verify(…)` with a new API. A backwards-compatible helper function exists to allow existing implementers to upgrade without concern for changed behavior, but SIWE 1.0 users are advised to review the upgrade section below.
- `ethers` has been updated to a peer dependency, allowing for more efficient builds.
- EIP-55 validation of EIP-155 is now enforced, and non-EIP-155 messages are considered as invalid.
- The `type` and `signature` properties have been removed from `SiweMessage`.
- The `not-before` message field is now checked during `verify`.
- This update introduces more granular error types returned after verification or message parsing failures: `EXPIRED_MESSAGE`, `INVALID_DOMAIN`, `DOMAIN_MISMATCH`, `NONCE_MISMATCH`, `INVALID_ADDRESS`, `INVALID_URI`, `INVALID_NONCE`, `NOT_YET_VALID_MESSAGE`, `INVALID_SIGNATURE`, `INVALID_TIME_FORMAT`, `INVALID_MESSAGE_VERSION`, and `UNABLE_TO_PARSE`.