Celebrating the experimental launch of hubs.neynar.com

Neynar

Is it possible to validate messages with our paid neynar service?

Framesjs has this middleware:

export const frames = createFrames({
  ...
  middleware: [
    farcasterHubContext({
      hubHttpUrl: isDev
        ? DEFAULT_DEBUGGER_HUB_URL
        : "https://nemes.farcaster.xyz:2281"
    }),

I tried to validate message with:

const frameHandler = frames(async (ctx: any) => {
  if (!ctx.message?.isValid) {
    console.log("Invalid message")
    throw Error("Invalid message")
  }

But that didn't seem to work and threw only invalid message errors. So thinking that it might be the usage of the official hub which causing the error or am I using this incorrectly?

Hey guys, we got a little issue with using validation service 👇

Building FOSS via @frames, /open-frames to help decentralized social win. a16z CSX23. farcasterchannels.com farcaster.id

cypherpunk wannabe, engineer working on @frames /open-frames /opencast
https://stephancill.co.za create stories at https://stories.steer.fun

Building @datalatte /datalatte, I care about data ownership and privacy 🎓|PhD in chip design 
💻|full-time engineer, part-time vanlifer🚐

Need to pass in valid message bytes. Hubs don’t validate fake bytes

@df @stephancill

👷 building @datalatte to democratize 📊 data & 🤖 AI
👨‍💻 fullstack engineer UI, backend, contracts, data pipelines,
✈️ traveling mostly between 🇩🇪 and 🇹🇭

building /neynar & /nfs 🪐 | neynar.com | writing bad casts on /rish 

@caruso33 if you're using the frames.js debugger you need to sign in with warpcast if you want to create messages that are recognized by neynar as valid

Thanks Stephan, I wasn't even aware that's possible with the debugger, nice!

So in general all messages can (and should) be validated through a hub, right?

Are there other recommended ways to make frames more secure?

it depends if your frame takes actions on behalf of the authenticated user e.g. updates a database entry or looks up sensitive information - in this case you should definitely verify that the message is valid

many frames don't do this and therefore don't need to make the additional request to a hub to validate a message

got it.

are there other safety measurements for frame related apps worth implementing?