security: add domain validation to SIWE authentication examples

[cryptoasuran]

Summary

Fixes cross-domain replay attack vulnerability in the authenticate-users guide backend examples.

Problem (Issue #1502)

The current backend verification code only checks the cryptographic signature without validating the SIWE message domain:

const valid = await client.verifyMessage({ address, message, signature });

This is insecure. A valid SIWE signature created for evil.com can be submitted to yourapp.com's /auth/verify endpoint and will pass verification, because verifyMessage only validates the cryptographic signature — not whether the message was intended for this domain.

EIP-4361 Requirement

EIP-4361 explicitly requires relying parties to validate the domain field:

"The full SIWE message MUST be checked for conformance... checked against expected values after parsing (e.g., expiration-time, nonce, request-uri, domain etc.)"

Solution

Replace verifyMessage with verifySiweMessage which validates domain, nonce, and expiry:

import { verifySiweMessage } from 'viem/siwe';

const valid = await verifySiweMessage(client, {
  address,
  message,
  signature,
  domain: 'yourapp.com', // Validates message was intended for this domain
});

Changes

• ✅ Updated both backend examples (inline + Express server)
• ✅ Added verifySiweMessage import from viem/siwe
• ✅ Added explicit domain parameter with comment
• ✅ Added security rationale comment in Express example

Impact

Before: Developers following this guide ship authentication endpoints vulnerable to cross-domain replay attacks.

After: Secure authentication that complies with EIP-4361 spec.

Testing

Code follows viem's official API:

• verifySiweMessage documentation

Fixes #1502

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/2	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2