Where is the nonce?

[enriquez]

The signed data looks like it is just the url with the params concatenated: https://github.com/bitpay/bitauth/blob/master/examples/client.js#L40

I expect a nonce to be included somewhere so that an attacker is unable to reuse a signature. I'm able to successfully run the following command multiple times against the example server.

curl --header 'x-pubkey: 02d7cfea0841ca90c67f5260013e2fadf86c7fe3587c58851e4489736bb8ed5863' --header 'x-signature: 304502210082b5d01ed62594a66382824236a5932a1ffcdb375a76d7adebbb5a0e803537d90220144c23ac7e576e1be157bc38e595279c18fe214f4a0a728084c0269fd52b5fec' http://localhost:3000/pizzas

[martindale]

The nonce is included in the body of the request, as a parameter within the data. The test server does not currently keep track of these nonces, but it sounds like it should. I'll open an issue for this, thanks!