v1.2.18 - Proactive auth timeout via lws_set_timeout: close idle unauthenticated connections after nip42_auth_timeout_sec even without REQ

api/index.html

@@ -288,8 +288,8 @@ AUTH RULES MANAGEMENT
         <!-- Auth Rule Input Section -->
         <div id="authRuleInputSections" style="display: block;">
             <div class="input-group">
-                <label for="authRulePubkey">Pubkey (nsec or hex):</label>
-                <input type="text" id="authRulePubkey" placeholder="nsec1... or 64-character hex pubkey">
+                <label for="authRulePubkey">Public Key (npub or hex):</label>
+                <input type="text" id="authRulePubkey" placeholder="npub1... or 64-character hex pubkey">
             </div>
             <div id="whitelistWarning" class="warning-box" style="display: none;">
                 <strong>⚠️ WARNING:</strong> Adding whitelist rules changes relay behavior to whitelist-only

api/index.js

@@ -3168,7 +3168,7 @@ function addBlacklistRule() {
     // Convert nsec or npub to hex if needed
     const hexPubkey = nsecToHex(inputValue);
     if (!hexPubkey) {
-        log('Invalid pubkey format. Please enter nsec1..., npub1..., or 64-character hex', 'ERROR');
+        log('Invalid public key format. Please enter npub1... or 64-character hex pubkey', 'ERROR');
         return;
     }
 
@@ -3220,7 +3220,7 @@ function addWhitelistRule() {
     // Convert nsec or npub to hex if needed
     const hexPubkey = nsecToHex(inputValue);
     if (!hexPubkey) {
-        log('Invalid pubkey format. Please enter nsec1..., npub1..., or 64-character hex', 'ERROR');
+        log('Invalid public key format. Please enter npub1... or 64-character hex pubkey', 'ERROR');
         return;
     }
 

src/config.c

@@ -952,6 +952,15 @@ static int validate_config_field(const char* key, const char* value, char* error
         return 0;
     }
 
+    // NIP-42 auth timeout
+    if (strcmp(key, "nip42_auth_timeout_sec") == 0) {
+        if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {
+            snprintf(error_msg, error_size, "invalid nip42_auth_timeout_sec '%s' (must be non-negative integer)", value);
+            return -1;
+        }
+        return 0;
+    }
+
     // SQLite performance tuning
     if (strcmp(key, "sqlite_mmap_size") == 0) {
         if (!is_valid_positive_integer(value) && strcmp(value, "0") != 0) {

src/default_config_event.h

@@ -83,6 +83,11 @@ static const struct {
     // IP-based rate limiting or access control (which would require firewall protection anyway)
     {"trust_proxy_headers", "true"},
 
+    // NIP-42 Authentication Timeout
+    // Seconds after connection before unauthenticated clients are disconnected (0 = disabled)
+    // Prevents unauthenticated connections from accumulating under heavy load
+    {"nip42_auth_timeout_sec", "10"},
+
     // SQLite Performance Tuning
     // mmap_size: bytes of database file to memory-map (0 = disabled, 268435456 = 256MB recommended)
     // Eliminates pread64 syscall overhead for database reads — significant CPU savings under load

src/main.h

@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 15
-#define CRELAY_VERSION "v1.2.15"
+#define CRELAY_VERSION_PATCH 18
+#define CRELAY_VERSION "v1.2.18"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"

src/nip042.c

@@ -126,6 +126,9 @@ void handle_nip42_auth_signed_event(struct lws* wsi, struct per_session_data* ps
         pss->challenge_expires = 0;
         pss->auth_challenge_sent = 0;
         pthread_mutex_unlock(&pss->session_lock);
+
+        // Cancel the auth timeout — client has authenticated, keep connection open
+        lws_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
         
         send_notice_message(wsi, pss, "NIP-42 authentication successful");
     } else {

src/websockets.c

@@ -545,6 +545,20 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
             memset(pss->active_challenge, 0, sizeof(pss->active_challenge));
             pss->challenge_created = 0;
             pss->challenge_expires = 0;
+
+            // Set libwebsockets auth timeout: if NIP-42 auth is required and the client
+            // doesn't authenticate within nip42_auth_timeout_sec seconds, lws will close
+            // the connection automatically — even if the client never sends a message.
+            // This prevents idle unauthenticated connections from accumulating.
+            if (pss->nip42_auth_required_events || pss->nip42_auth_required_subscriptions) {
+                int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                if (auth_timeout > 0) {
+                    lws_set_timeout(wsi, PENDING_TIMEOUT_AWAITING_PING, auth_timeout);
+                    DEBUG_TRACE("Auth timeout set: %d seconds for unauthenticated connection from %s",
+                                auth_timeout, pss->client_ip);
+                }
+            }
+
             DEBUG_TRACE("WebSocket connection initialization complete");
             break;
             
@@ -1011,6 +1025,21 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                         } else {
                                             send_notice_message(wsi, pss, "NIP-42 authentication required for subscriptions");
                                             DEBUG_WARN("REQ rejected: NIP-42 authentication required");
+
+                                            // Auth timeout: close connection if challenge was sent but client
+                                            // hasn't authenticated within nip42_auth_timeout_sec seconds
+                                            int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                                            if (auth_timeout > 0 && pss->connection_established > 0) {
+                                                time_t connection_age = time(NULL) - pss->connection_established;
+                                                if (connection_age >= auth_timeout) {
+                                                    DEBUG_LOG("Closing unauthenticated connection from %s after %ld seconds (timeout=%d)",
+                                                              pss->client_ip, connection_age, auth_timeout);
+                                                    lws_close_reason(wsi, LWS_CLOSE_STATUS_POLICY_VIOLATION,
+                                                                     (unsigned char*)"Authentication timeout", 22);
+                                                    cJSON_Delete(json);
+                                                    return -1;
+                                                }
+                                            }
                                         }
                                         cJSON_Delete(json);
                                         // Note: complete_message points to reassembly_buffer, which is managed separately
@@ -1768,6 +1797,22 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                                     } else {
                                         send_notice_message(wsi, pss, "NIP-42 authentication required for subscriptions");
                                         DEBUG_WARN("REQ rejected: NIP-42 authentication required");
+
+                                        // Auth timeout: close connection if challenge was sent but client
+                                        // hasn't authenticated within nip42_auth_timeout_sec seconds
+                                        int auth_timeout = get_config_int("nip42_auth_timeout_sec", 10);
+                                        if (auth_timeout > 0 && pss->connection_established > 0) {
+                                            time_t connection_age = time(NULL) - pss->connection_established;
+                                            if (connection_age >= auth_timeout) {
+                                                DEBUG_LOG("Closing unauthenticated connection from %s after %ld seconds (timeout=%d)",
+                                                          pss->client_ip, connection_age, auth_timeout);
+                                                lws_close_reason(wsi, LWS_CLOSE_STATUS_POLICY_VIOLATION,
+                                                                 (unsigned char*)"Authentication timeout", 22);
+                                                cJSON_Delete(json);
+                                                free(message);
+                                                return -1;
+                                            }
+                                        }
                                     }
                                     cJSON_Delete(json);
                                     free(message);