Exit to App
Security

Session Security

Sign-In with Ethereum (EIP-4361), single-use nonces, and secure cookie hygiene.

User authentication conforms to EIP-4361 standards:

  • Single-Use Nonces: Nonces are cryptographically generated, stored in PostgreSQL with a 5-minute TTL, and deleted immediately upon first verification to prevent replay attacks.
  • Session Cookies: Sessions are issued as HttpOnly, SameSite=Strict, Secure JWT cookies, preventing JavaScript injection attacks and cross-site request forgery.
  • Session Expiry: Sessions automatically expire after 24 hours of inactivity or upon explicit logout.