Passwordless Third Party Logins – How Do I Authenticate A Zucoin Wallet On My Website Or App? (Using PHP)

<?php
/**
 * Uses data in URL query variables to parse and validate an incoming
 * user authentication request. Use the result to verify a user in a 
 * back-end system and/or redirect them to a desired endpoint
 *
 * @tip Use a sodium encryption library, e.g. 
 * https://www.php.net/manual/en/book.sodium.php is built into PHP 
 * 7.2 and above
 *
 * @returns array|bool An associative array of authentication data on 
 * success and false on fail
 */
function validate_incoming_user_authentication_request()
{
	// Get URL query variables
	$url_params = $_GET;

	// Note: In PHP, URL query parameters are automatically URL-decoded
	$referral_source = isset($url_params['utm_source'])? 
		$url_params['utm_source']: 
		null;

	// Check if a splitchain authentication pass through has occurred
	if ($referral_source && strpos($referral_source, 'zucoin_wallet_app_v') !== false) 
	{
		// Not a zucoin wallet app referral

		return false;
	}

	$version = isset($url_params['zucoin__data_pass_through__version'])? 
		$url_params['zucoin__data_pass_through__version']: 
		null;

	if ($version !== '1') 
	{
		// Unsupported data pass through version

		return false;
	}

	$key_public_base64urlsafe = isset($url_params['zucoin__data_pass_through__key_public__base64urlsafe'])? 
		$url_params['zucoin__data_pass_through__key_public__base64urlsafe']: 
		null;

	// Will contain a timestamp in secs
	$timestamp_secs_raw = isset($url_params['zucoin__data_pass_through__data_timestamp_secs'])? 
		$url_params['zucoin__data_pass_through__data_timestamp_secs']: 
		null;

	if (
		!$timestamp_secs_raw ||
		!is_string($timestamp_secs_raw) ||
		!ctype_digit($timestamp_secs_raw)
	) 
	{
		// Invalid timestamp secs provided

		return false;
	}

	$timestamp_secs = (int)$timestamp_secs_raw;

	$timestamp_secs_signature_base64urlsafe = 
		isset($url_params['zucoin__data_pass_through__data_timestamp_secs_signature__base64urlsafe'])? 
		$url_params['zucoin__data_pass_through__data_timestamp_secs_signature__base64urlsafe']: 
		null;

	// Verify the signed data
	$signature_binary = sodium_base642bin(
		$timestamp_secs_signature_base64urlsafe,
		SODIUM_BASE64_VARIANT_URLSAFE
	);

	$key_public_binary = sodium_base642bin(
		$key_public_base64urlsafe,
		SODIUM_BASE64_VARIANT_URLSAFE
	);

	$verified = sodium_crypto_sign_verify_detached(
		$signature_binary,
		// Ensure the timestamp is a string as required by sodium_crypto_sign_verify_detached
		(string) $timestamp_secs, 
		$key_public_binary
	);

	if (!$verified) 
	{
		// Cryptographic signature verification failed. Invalid details provided

		return false;
	}

	return [
		'referral_source' => $referral_source,
		'version' => $version,
		'key_public_base64urlsafe' => $key_public_base64urlsafe,
		'timestamp_secs' => $timestamp_secs,
		'timestamp_secs_signature_base64urlsafe' => $timestamp_secs_signature_base64urlsafe,
	];
}

<?php
// (Result from above)
$zucoin_user_authenticated = validate_incoming_user_authentication_request();

if (!$zucoin_user_authenticated) 
{
    // Stop, invalid
}

// Check if it's too old
function is_expired_incoming_user_authentication_request($auth_data)
{
	$time_now_secs = time();
	$time_passed_secs = $time_now_secs - $auth_data['timestamp_secs'];
	$expiry_time_secs = 30;

	if ($time_passed_secs > $expiry_time_secs) 
	{
		// Authentication data is too old to be valid, fail

		return true;
	}

	// Authentication data is recent

	return false;
}

$expired = is_expired_incoming_user_authentication_request($zucoin_user_authenticated);

if ($expired) 
{
	// Stop, invalid
}