Scope
File: src/hooks/useWeb3Auth.ts
Problem
The current auth hook connects on mount without challenge verification, stores the secret key in localStorage in plaintext, and never expires sessions. This violates Web3 security best practices where each session should be established via a cryptographic signature handshake using a non-expiring public key but an expiring session token.
Requirements
- Implement a challenge-response handshake:
- Backend or hook generates a random challenge string + nonce.
- Wallet signs
challenge + nonce with Keypair.sign().
- Signature is verified against the stored public key before session establishment.
- Session token must be distinct from the secret key — store only the signed challenge token in localStorage, never the secret key.
- Add
CHALLENGE_DURATION_MS (30 min default) after which isAuthenticated returns false and a re-challenge is required.
- Expose
signChallenge(challenge: string): Promise<string> for downstream use in API auth headers.
- On
disconnect, wipe all session artifacts from context and storage.
Resolution Strategy
- Keep keypair only in
useRef (never serialized).
- Store
{ address, network, signature, expiresAt } in localStorage.
- Validate
expiresAt > Date.now() on mount and on every context read.
Tags
hooks, wallet, security, auth
Scope
File:
src/hooks/useWeb3Auth.tsProblem
The current auth hook connects on mount without challenge verification, stores the secret key in localStorage in plaintext, and never expires sessions. This violates Web3 security best practices where each session should be established via a cryptographic signature handshake using a non-expiring public key but an expiring session token.
Requirements
challenge + noncewithKeypair.sign().CHALLENGE_DURATION_MS(30 min default) after whichisAuthenticatedreturns false and a re-challenge is required.signChallenge(challenge: string): Promise<string>for downstream use in API auth headers.disconnect, wipe all session artifacts from context and storage.Resolution Strategy
useRef(never serialized).{ address, network, signature, expiresAt }in localStorage.expiresAt > Date.now()on mount and on every context read.Tags
hooks, wallet, security, auth