From e6a7540f1e319cd880273b93546ac5a8a8b2a207 Mon Sep 17 00:00:00 2001 From: Igor Osipov Date: Mon, 28 Sep 2026 19:53:27 +0200 Subject: [PATCH 1/2] docs(world-id): check verification environment in backend example --- world-id/idkit/integrate.mdx | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/world-id/idkit/integrate.mdx b/world-id/idkit/integrate.mdx index 1b98939..0150706 100644 --- a/world-id/idkit/integrate.mdx +++ b/world-id/idkit/integrate.mdx @@ -336,6 +336,22 @@ export async function POST(request: Request): Promise { return NextResponse.json({ error: "Verification failed" }, { status: 400 }); } + const verification = await response.json(); + + /* + * Set the expected environment on your backend. Accept a proof only if the + * verification response reports that environment. Production backends must + * reject staging and sandbox proofs. + */ + const expectedEnvironment = "production"; + + if ( + verification?.success !== true || + verification?.environment !== expectedEnvironment + ) { + return NextResponse.json({ error: "Verification failed" }, { status: 400 }); + } + // Uniqueness: store the nullifier (Step 6). // Sessions: validate and store the session result (see the session guide). return NextResponse.json({ success: true }); From 131e3d2b2855a27598593b3b15456ef0c7c82478 Mon Sep 17 00:00:00 2001 From: Igor Osipov Date: Tue, 29 Sep 2026 13:48:39 +0200 Subject: [PATCH 2/2] docs: pin World ID verification environment --- world-id/idkit/integrate.mdx | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/world-id/idkit/integrate.mdx b/world-id/idkit/integrate.mdx index 0150706..5678f2e 100644 --- a/world-id/idkit/integrate.mdx +++ b/world-id/idkit/integrate.mdx @@ -323,12 +323,25 @@ export async function POST(request: Request): Promise { idkitResponse: IDKitResult; }; + /* + * Set the expected environment on your backend. Reject proofs from other + * environments before verification, including staging and sandbox in production. + */ + const expectedEnvironment = "production"; + + if (idkitResponse?.environment !== expectedEnvironment) { + return NextResponse.json({ error: "Verification failed" }, { status: 400 }); + } + const response = await fetch( `https://developer.world.org/api/v4/verify/${rp_id}`, { method: "POST", headers: { "content-type": "application/json" }, - body: JSON.stringify(idkitResponse), + body: JSON.stringify({ + ...idkitResponse, + environment: expectedEnvironment, + }), }, ); @@ -338,13 +351,6 @@ export async function POST(request: Request): Promise { const verification = await response.json(); - /* - * Set the expected environment on your backend. Accept a proof only if the - * verification response reports that environment. Production backends must - * reject staging and sandbox proofs. - */ - const expectedEnvironment = "production"; - if ( verification?.success !== true || verification?.environment !== expectedEnvironment