Metamask says site is not secure

#9

There are about 5 threads on this issue. I have tested the ThirdWeb auth demo and it works without this issue in MetaMask so it isn’t an issue with MetaMask. Can you (or someone else) answer this?

If NEXTAUTH_URL=http://localhost:3000
What should APP_DOMAIN be?

#10

Hey @mrepad, did you try localhost:3000 for the APP_DOMAIN?

#11

the domain/subdomain from the website that you access has to match the domains/subdomain from the message to sign, if they don’t match then you will see that warning, if you use localhost with a port then you can use ngrok proxy to get a domain that doesn’t have a port number

#12

you need to provide the domain used in the browser and the domain used in the message to sign to be able to help

#13

@YosephKS YosephKS localhost:3000 gives this error

Unhandled Runtime Error

AxiosError: [C0006] Request failed, Bad Request(400): domain must be a valid domain name

@cryptokid Here’s a silly question. How do you put the domain in the message? In the tutorial there isn’t a message. I had to add statement: ‘Please confirm to authenticate yourself.’, to signin.jsx

#14

What is the tutorial that you follow? When you request the message for authentication api you can specify the domain.

#15

in authService.ts I set the proper domain, not localhost.

#16

And when you access the website what domain is in the browser url that is accessed?

#17

signin.jsx doesn’t have a statement to sign

#18

I’ll take a look today to see what happens

#19

the url in the browser is the normal domain I set for the website. Everything is fine, it is ssl secured. But metamask says signing from localhost:1337

#20

Do you use discord? Can you send me a screenshot on discord?

#21

Yes, in a few minutes. Thanks

#22

Okay, so to anyone who stumbles upon this post in despair, this is what fixed it.
First of all, changing the domain and uri in authService.ts doesn’t seem to change anything. So to change the domain and url, you have to either :
hardcode it in the same authService.ts file, change this

const result = await Moralis.Auth.requestMessage({
address,
chain,
networkType,
domain:url.hostname,
uri: url.ToString(),
statement: STATEMENT,
notBefore: now.toISOString(),
expirationTime: expirationTime.toISOString(),
timeout: TIMEOUT,
});

into this

const result = await Moralis.Auth.requestMessage({
address,
chain,
networkType,
domain: ‘domain’,
uri: ‘https://domain’,
statement: STATEMENT,
notBefore: now.toISOString(),
expirationTime: expirationTime.toISOString(),
timeout: TIMEOUT,
});

or, open config.ts and change the SERVER_URL parameter (haven’t tested this out yet, but should work)

1 Like
#23

I’ve cured this with ngrok. APP_DOMAIN is exactly the same as NEXTAUTH_URL but without https://

New problem. The signature is given (I can see it in web developer tools), but the signin page doesn’t redirect to the user page like it is supposed to!

#24

I don’t know what this means

#25

As seen in this youtube video. Once the user has signed the message, the user page should load in the browser and show the session data

#26

ok, you get any error, what happens?

#27

No errors. It stays on the signin page. If I try to go to the user page eg xxxx-xx-x-xxx-xxx.eu.ngrok.io/user it just reverts back to the signin page. This is only supposed to happen if the user hasn’t authenticated.

Many thanks for your help

#28

you are using a self hosted parse server or you use nextjs?

does it work without ngrok and with that warning?