Description
Wallet-pairing sessions never expire and are never rotated. The rewrite already replaced the hardcoded AES-GCM key from paritytech/dotli-archive#111 with a per-install random key and fresh nonces, but a stolen session record stays valid forever. Sessions should get a TTL, rotation on use, and a way to revoke them.
Motivation
This is the remaining gap from AUTH-VULN-01 in the old security audit (paritytech/dotli-archive#111). Recreated here because the archive repo is locked.
Description
Wallet-pairing sessions never expire and are never rotated. The rewrite already replaced the hardcoded AES-GCM key from paritytech/dotli-archive#111 with a per-install random key and fresh nonces, but a stolen session record stays valid forever. Sessions should get a TTL, rotation on use, and a way to revoke them.
Motivation
This is the remaining gap from AUTH-VULN-01 in the old security audit (paritytech/dotli-archive#111). Recreated here because the archive repo is locked.