hloth/session-watchos-website
Archived
1
0
Fork 0
Code Issues Pull requests Activity
Website for Session watch OS client
This repository has been archived on 2025-09-14. You can view files and clone it, but you cannot make any changes to its state, such as pushing and creating new issues, pull requests or comments.
5 commits 1 branch 0 tags 610 KiB
Find a file
Exact
VityaSchel 04f09a122a
 Add README and fix mnemonic length
2024-05-08 19:05:09 +04:00
.vscode Add main page 2024-03-16 15:56:37 +04:00
docs Add README and fix mnemonic length 2024-05-08 19:05:09 +04:00
public Add main page 2024-03-16 15:56:37 +04:00
src Add README and fix mnemonic length 2024-05-08 19:05:09 +04:00
.eslintrc.cjs Add main page 2024-03-16 15:56:37 +04:00
.gitignore Add main page 2024-03-16 15:56:37 +04:00
next.config.mjs Add main page 2024-03-16 15:56:37 +04:00
package.json Change DB to redis 2024-03-17 02:06:52 +04:00
pnpm-lock.yaml Change DB to redis 2024-03-17 02:06:52 +04:00
postcss.config.js Add main page 2024-03-16 15:56:37 +04:00
README.md Add README and fix mnemonic length 2024-05-08 19:05:09 +04:00
tailwind.config.ts Add main page 2024-03-16 15:56:37 +04:00
tsconfig.json Add encryption and in-memory db 2024-03-17 00:55:03 +04:00

README.md

Session watch OS client website

Website for Session watch OS client

Screenshot1 Screenshot2

Used to sign in with mnemonic into the app. Mnemonic is encrypted with a key that is not sent to server.

Usage

  1. Clone repository
  2. Run Redis database with npm run db
  3. Run Next.js server with npm run dev

Login flow

  1. Make GET request to /api/start-login-flow, it will respond with JSON like {"ok": true,"flowID": "URlf0dTn8"}
  2. Generate AES-256 key for encryption and store it in a local variable, it will be used later for decryption. Encode it in base64 as iv+key where iv is 16 bytes length and key is 32 bytes length
  3. Grab that flowID and open /login/[flowID]#[encryptionKey] page. For example /login/URlf0dTn8#123456789
  4. User will input their mnemonic, and it will be stored in Redis database encrypted with this key. Encryption is done clientside in browser, server only receives encrypted mnemonic and never receives key.
  5. Periodically check /api/login-flow-result/[flowID], it will respond with JSON like {"ok": true,"result": null} meaning user has not yet inputted their mnemonic. Once result is string, decrypt it with the key and you've got what user inputted. As soon as server responded with resulted encrypted string, this flow will be deleted and you won't be able to request results for the same flow again