The problem:

In strategy.js, there's a validation for URI and Domain:

  var origin = utils.originalOrigin(req);
  if (origin !== siweMessage.uri) {
    return self.fail({ message: 'URI mismatch.' }, 403);
  }
  
  var domain = url.parse(origin).host;
  if (domain !== siweMessage.domain) {
    return self.fail({ message: 'Domain mismatch.' }, 403);
  }

It uses the Host header, which is the backend's domain (which is often different from the client's domain).
Earlier it was fine and I just used backend's domain for the message. But recently I noticed that MetaMask shows a warning to the user:

So for example, when my client is example.com, and the backend is api.example.com, this strategy allows me to use api.example.com, whereas MetaMask requires me to use example.com.

Possible solution:

In my personal project, I just made my own passport strategy and modified the validation to check the domain of origin:

const domain = url.parse(req.get("origin")).host;
if (siwe.domain !== domain)
  throw new Error({ message: "Domain does not match." });

Not sure if this strategy is still maintained, but would be nice if someone fixed it (or created another).

First, let me thank you @jaredhanson for all the great work you've done getting Passport to be such a useful set of modules (apologies if I'm minimizing the library of tools you've built).

I love that you built something for Ethereum, and given that it's only been about 2 weeks since release, there probably haven't been enough people working on it to run into these issues.

Heads up: This took me 12+ hrs to figure out, and to be honest, I'm not sure what the proper solution should be. But the source of the problem is in how tls is defined in the utils.js file.

This works fine in localhost and http. But when trying to access from https, I was constantly receiving a 403 Authorization Error, URI Mismatch. I thought this was something I had done, so I read all the documentation (like 5 times), tested all my code, and still couldn't identify the source. At first, I didn't even realize that http worked - I learned that by accident.

When I started playing with the module (around the 10th hour), that's when things started to click.

It's the logic for how tls is defined that seems to continue to default my Heroku server with SSL (when I'm hitting the https URL) to http which creates the URI Mismatch since https != http.

This is what I did to fix it on my end (had to bring this out from being a module and instead make it my own directory).

I hope that this is useful. Please let me know when you've resolved this. I don't know much about the technical details of http vs https, so I'm not sure if my solution is fully secure.

Thanks again for what you've built!