From 703d329afa174b4c904b4b79c2ef990d9f69b63d Mon Sep 17 00:00:00 2001
From: silentgeckoaudit3801 <silentgeckoaudit3801@outlook.com>
Date: Thu, 23 Jul 2026 14:39:17 -0600
Subject: [PATCH] fix: expire stale auth challenges

---
 backend/src/services/authService.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/services/authService.ts b/backend/src/services/authService.ts
index dec1cd20..2a762f6f 100644
--- a/backend/src/services/authService.ts
+++ b/backend/src/services/authService.ts
@@ -73,7 +73,7 @@ export function verifyChallengeTimestamp(
   maxAgeMs: number = CHALLENGE_EXPIRES_IN_MS,
 ): boolean {
   const now = Date.now();
-  return timestamp - now <= maxAgeMs;
+  return now - timestamp <= maxAgeMs;
 }
 
 export function generateJwtToken(publicKey: string): string {