WIP: Propose a new query session protocol to avoid signing every request

[imotai]

Motivations

Each query in db3 needs to be signed with the user's private key. It has a poor user experience and some potential security issues, so I propose a new protocol that the signature is required only when opening the session and closing the session.

the protocol has the following steps

1. open a query session with the user's signature
2. the node checks the validity of the signature and returns a session token
3. the SDK sends queries to the node with a valid token
4. when the session reaches its limit of query count, the SDK closes the session with the user's signature

Solution

Security

Alternatives

Additional context

How did the others solve this problem

• the graph, their use an API token to solve this problem in a centralized way
• space and time, they are the same with the graph
• kwil, they have the same problem and they need the user's private key to initialize their SDK

Discussion

Status

• rust SDK feat: support session token #187
• typescript sdk typescript sdk for the query session #217

[xuman2019]

In the session architecture pic, is it possible to add a 'wallet' diagram element in a dApp view?

[imotai]

In the session architecture pic, is it possible to add a 'wallet' diagram element in a dApp view?

good suggestion

[jingchen2222]

CheckList

• Add session token and query with token instead of session id feat: support session token #187
• Support query without signature when given a session token