Splinterlands Land Manager Update: Security, UI Improvements & Planning Fixes
Welcome back Splinterfam!
Today we have another release for the Splinterlands Land Manager site.
This update contains several UI improvements, some planning fixes that were already delivered earlier this week, and one pretty important security improvement thanks to 
We have spoken a couple of times about our projects and shared some insights into how we build things. This time that basically resulted in him letting his AI loose on my repository to see if it could find any security issues.
And to my surprise, it actually found one that needed addressing.
The scenario was pretty far stretched, but nevertheless, if there is a security gap that can be closed, I want to close it.
🙌 Support the Project
✅ Upvote this post – it really helps!
👉 Vote for My SPS Validator Node
💬 Ideas and feature requests are always welcome. No promises but I will take a look and try my best.
🤓 Nerd Alert: Fixing Player Impersonation
The issue was related to how the site validated the Splinterlands login cookie.
Previously, the server decoded the JWT token stored in the cookie and used the player name inside that token. The problem was that decoding a token does not prove that Splinterlands actually issued that token.
In theory, someone could create a forged token containing another player's username and try to make the server believe they were that player.
This was especially important because the Land Manager has a few actions where my service account can perform transactions on behalf of another player, such as renting workers or making market purchases.
There was still another layer of protection here. The targeted player would need to have previously granted the required authority to the service account. So an attacker could not simply pick any Splinterlands account and start making transactions.
Still, theoretically possible is enough reason to fix it.
The server now does not just read the username from the cookie. It also verifies the token with Splinterlands before trusting that identity.
So basically:
Cookie says you are Beaker? Cool. Let me ask Splinterlands if that cookie actually belongs to Beaker first. 😅
Forged, expired, revoked, malformed, or otherwise invalid tokens are rejected.
I also added regression tests around this authentication boundary, including forged tokens, impersonation attempts, expired tokens, missing cookies, admin authorization, and API failure scenarios.
Big thanks to
Removing GitHub Authentication
Along with that security change, I finally removed something that had been sitting on my TODO list for quite some time.
The separate GitHub authentication for the admin functionality is gone.
Admin access now simply uses the already verified Splinterlands identity and checks whether that account matches the configured admin account.
That means one less authentication system, one less dependency, and less configuration to maintain.
Always nice when an update makes something more secure while also allowing me to delete code. 😄
HiveAuth Experiment
There was actually another nice bit of cooperative building with
He implemented HiveAuth signing in my repository, which was really cool to test and play around with.
For now, however, I reverted it.
HiveAuth has a slightly different signing flow compared with Hive Keychain. Supporting it properly means more than just adding another signing method.
For example, when a transaction needs approval on your phone, the UI should clearly tell you that it is waiting for you. If someone forgets about the request, timeout and error handling also need to behave correctly.
Because signing happens in quite a few different places on the site, I would need to adjust all those flows properly.
So instead of half implementing it, I moved the work into a separate branch and put it on the backlog for another day.
My experience with HiveAuth in the past has been similar. It is a nice solution, especially when using mobile devices, but when I am already sitting in my browser I personally still prefer the Hive Keychain extension.
Nevertheless, thanks again
Land Manager Improvements
Security was not the only thing happening this week.
There were also several smaller improvements to the Land Manager.
Harvest Now Shows the Expected Result
The Harvest button now shows the expected result of the action directly where possible.
The detailed information is still available in the separate pane, but you now get the most useful information immediately when performing the action.
Make Harvestable:
Harvest ALL:
Hasvest Mythics:
Top Up Pools:
Post Processing:
Detail reasoning is still present:
A small UI change, but hopefully one that makes the harvesting flow a little clearer.
Production Table Improvements
The Production table now also shows the Totem and Title assigned to a plot.
I also improved what happens after making production changes.
The loading screen is updated properly after an update, and there is now a confirmation message after saving your changes.
Again, nothing revolutionary, just making the workflow a little nicer.
Planning Fixes
There were also some important improvements behind the scenes in the planning calculations, thanks for reporting this 
The planner can now use the provided Land Base PP from the land collection and staked card information.
This is especially important for over combined cards.
Previously, BCX cap calculations could underestimate the actual base PP in those situations. When the Land API already provides the correct base PP, the planner now prefers that value instead of trying to reconstruct it itself.
Basically, when Splinterlands already tells me the answer, I should probably use it. 😅
Top Up Pool Adjustment
I also removed the drift calculation from the Top Up Pool calculation.
The drift calculation could become inaccurate when a manual harvest was performed on only one plot.
Removing it makes the Top Up Pool calculation more predictable in those situations.
Closing
So quite a mixed release this time.
Some UI improvements, some calculation fixes, some cleanup, and one security issue that I definitely did not expect to find when
That is also one of the fun parts about sharing projects and talking with other builders. Sometimes you get a feature idea, sometimes someone points out a better way of doing something, and sometimes they let an AI loose on your repository and come back with a security issue. 😂
Thanks again
As always, if you notice something strange, have an improvement in mind, or manage to break something I thought was unbreakable, let me know!
See you in the next update.
Beaker signing off.
Want to be part of this amazing play-to-earn game? Consider using my referral link!