This project is not covered by Drupal’s security advisory policy.

SIWE Login lets people sign in to a Drupal site with an Ethereum wallet. They sign a short message in their wallet, following the Sign-In with Ethereum standard (EIP-4361), and no password is needed.

Features

  • Strict EIP-4361 parsing and signature checks, tested against the official SpruceID test vectors.
  • Single-use nonces, bound to the browser session and the wallet address, so a captured signature can't be replayed.
  • Domain, URI, chain ID and expiry checks. Only what the wallet signed is trusted.
  • Flood control on the sign-in routes, using core's flood service like the normal user login.
  • Optional email verification for new accounts, and optional username creation for wallets without an ENS name.
  • Safe account linking: a wallet whose email matches an existing account is linked only after that inbox is confirmed.
  • Optional ENS name lookup and validation.
  • Works on sites installed under a sub-path or with a language prefix.
  • A configurable sign-in block, and hook_siwe_login_response_alter() so other modules can change the response, for example the redirect.
  • Smart-contract wallets (EIP-1271) are refused with a clear message; only regular wallet accounts sign in.

What a visitor needs

A browser wallet: an extension such as MetaMask or Rabby, or a wallet app's built-in browser. An optional Web3Onboard client (off by default) is also included.

Requirements

  • Drupal 10 or 11.
  • PHP's GMP or BCMath extension. GMP is faster. On a BCMath-only host, add config.platform.ext-gmp to the site's root composer.json; the README explains how.
  • Optional: web3p/web3.php for ENS name lookup. Without it, sign-in works and the ENS features stay off.

The site doesn't need to install any JavaScript: the module loads a pinned copy of ethers (6.16.0) with a Subresource Integrity hash.

Installation

  1. composer require 'drupal/siwe_login:^1.0@beta'
  2. Enable the module. It creates the field_ethereum_address field on user accounts.
  3. Check the settings at Configuration › People › SIWE Login (/admin/config/people/siwe). The expected domain is detected on install.
  4. Place the SIWE Login block in a region.

Security

Upgrade to the latest beta: 1.0.0-beta5 to beta8 fixed nonce replay, client-supplied field overrides and other issues. This project has not opted into security advisory coverage yet. The module's threat model is public: THREAT-MODEL.md.

Related

Developed for LocalNodes. Bug reports and patches are welcome in the issue queue.

Project information

Releases

1.0.0-beta12 released 12 November 2026
Works with Drupal: ^10 || ^11
Install:

Development version: 1.0.x-dev updated 12 Nov 2026 at 13:44 UTC

Using Composer to manage Drupal site dependencies