AEX-4 - æternity wallet deep linking specification

Hi all, This is the discussion thread for aex-4:


I think it’s reasonable to have this specification. What you are proposing sounds good.

1 Like

I also like the idea. we should just take a cautious look at possible security implications of allowing to pass arbitrary callback URLs. My gut tells me that this could somehow be misused in order to mislead users and/or trick them into performing something they didn’t intend to. Any thoughts?

1 Like

Passing arbitrary callback URL has its security implications when you’re passing user sensitive information to it. But here the wallet only has to post the transaction id of the payment done and that is already public.

We’ve documented the base standard(that should be there) and this can be further extended upon by wallets and vendors to enhance the overall security as they seem fit.

I like the proposal, here my feedback:

  • Is there a specific reason why some arguments are passed as “path” and not as “parameters”?
  • Callback URL’s can as already mentioned be used for XSS-like attacks.
  • Keep in mind that aeternity is a smart contract capable blockchain, payments are only one use case, do we want this standard to cover payments only?
  • Goes in the direction of the previous 2 points. Wouldn’t it make sense to remove callback and add a payload instead? -> Merchant redirects you as soon as payment was received + you can add a payment id to the payload (if as a merchant you don’t use 1address per payment).
1 Like

due to the difficulty to agree on the details of the specification it was decided to withdraw the AEX, we may work to an implementation first if there is a use case and then make an AEX proposal

1 Like

The Base aepp is experimenting with this method of connecting aepps with wallets. We will share our prototype in our next release and can discuss making a standard out of it after we gather everyone’s feedback.