Potential fix for code scanning alert no. 11: Clear text storage of sensitive information

[Dargon789]

Potential fix for https://github.com/Dargon789/aa-sdk/security/code-scanning/11

To fix the vulnerability, we should ensure that any sensitive session data written to localStorage is encrypted before storage, and decrypted when read back. The best way to do this is to use a strong symmetric encryption algorithm from a well-known library, such as AES from Node.js's built-in crypto module (also available via browser-compatible polyfills when needed). We will introduce a simple encrypt and decrypt utility, use it to wrap the session when serializing/deserializing in setTemporarySession and getTemporarySession. The encryption key should be provided via configuration (never hard-coded) and must be kept securely (outside localStorage). For simplicity, we'll define a placeholder for obtaining the key (this could be derived from user authentication context or other secure mechanism).

Changes required:

• Add an import of a Crypto library for encryption/decryption (Node's built-in crypto in Node environments; for browser, use the Web Crypto API, here we'll show the Node/Polyfill import for universality).
• Define encrypt and decrypt helpers.
• Update setTemporarySession to store the encrypted session object string.
• Update getTemporarySession to read, decrypt, parse, and return the session object.
• (Optionally) introduce configuration for encryption key origin.

All changes will be made in account-kit/signer/src/session/manager.ts.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by Sourcery

Secure temporary session storage by encrypting data in localStorage with AES using a configurable key

New Features:

• Encrypt temporary session data before writing to localStorage and decrypt it upon retrieval

Enhancements:

• Introduce encryptSession and decryptSession helpers and require a configurable SESSION_ENCRYPTION_KEY

Build:

• Add crypto-js dependency for encryption functionality

[sourcery-ai]

Reviewer's Guide

This PR secures temporary session storage by introducing AES-based encryption and decryption utilities with PBKDF2 key derivation, wiring them into the session manager methods, and configuring the encryption key via environment variables.

Sequence diagram for storing an encrypted temporary session

sequenceDiagram
  participant SessionManager
  participant CryptoJS
  participant LocalStorage
  SessionManager->>encryptSession: encryptSession(session, key)
  encryptSession->>CryptoJS: AES.encrypt(JSON.stringify(session), derivedKey)
  encryptSession-->>SessionManager: encryptedData
  SessionManager->>LocalStorage: setItem(key, encryptedData)

Loading

Sequence diagram for retrieving and decrypting a temporary session

sequenceDiagram
  participant SessionManager
  participant LocalStorage
  participant decryptSession
  participant CryptoJS
  SessionManager->>LocalStorage: getItem(key)
  LocalStorage-->>SessionManager: encryptedData
  SessionManager->>decryptSession: decryptSession(encryptedData, key)
  decryptSession->>CryptoJS: AES.decrypt(encryptedData, derivedKey)
  decryptSession-->>SessionManager: sessionObject

Loading

Entity relationship diagram for encrypted session storage format

erDiagram
  SESSION {
    string salt
    string ciphertext
  }
  SESSION ||--o{ LOCAL_STORAGE : stores
  LOCAL_STORAGE {
    string key
    string value
  }

Loading

Class diagram for updated SessionManager and encryption utilities

classDiagram
  class SessionManager {
    +setTemporarySession(session: TemporarySession)
    +getTemporarySession(): TemporarySession | null
    +on<E>(event: E, handler: function)
    sessionKey: string
    storage: Storage
  }
  class encryptSession {
    +encryptSession(sessionObj: object, keyParam?: string): string
  }
  class decryptSession {
    +decryptSession(data: string, keyParam?: string): any | null
  }
  SessionManager --> encryptSession : uses
  SessionManager --> decryptSession : uses

Loading

File-Level Changes

Change	Details	Files
Configure session encryption key	Define SESSION_ENCRYPTION_KEY constant from environment Validate presence of encryption key in helpers and throw errors if missing	account-kit/signer/src/session/manager.ts
Implement encryptSession and decryptSession helpers	Generate random salt and derive key with PBKDF2 Encrypt session JSON to ciphertext with salt prefix Parse salt and ciphertext to decrypt and JSON-parse session	account-kit/signer/src/session/manager.ts
Encrypt session data on write	Call encryptSession instead of JSON.stringify in setTemporarySession Update comment to reflect encryption step	account-kit/signer/src/session/manager.ts
Decrypt session data on read	Retrieve raw cipher text and handle missing value Invoke decryptSession and return parsed session object	account-kit/signer/src/session/manager.ts
Add crypto-js dependency	Include crypto-js in dependencies for encryption support	account-kit/signer/package.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[snyk-io]

⚠️ Snyk checks are incomplete.

Status	Scanner	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🌿 Documentation Preview

Name	Status	Preview	Updated (UTC)
Alchemy Docs	❌ Failed		Oct 28, 2025, 9:33 AM

[Dargon789]

To fix this issue:

• Replace the hardcoded encryption key and PBKDF2 with a secure password-based key derivation that uses a high-entropy secret or per-user unique key for derivation. Ideally, the key should come from secure configuration, not be hardcoded in source.
• If storing passwords, switch to a more secure password hashing scheme like bcrypt, scrypt, or argon2. However, for encryption of session objects, the critical part is the derivation and secrecy of the key.
• You should change the SESSION_ENCRYPTION_KEY so it's not hardcoded, and adjust encryptSession and decryptSession so they accept a key argument from outside—provided per session or loaded from a secure environment variable.
• In case you need to hash passwords (not just encrypt data), switch to using bcrypt with a proper salt and rounds.
• In account-kit/signer/src/session/manager.ts, update the key derivation so it uses a non-hardcoded key. For demonstration, retrieve the key from an environment variable (if possible), or make it injectable.
• If you have access, you might use bcryptjs for portable bcrypt hashing (if you must do password hashing).
• Add a check that throws an error if the session encryption key is unset.
• Clearly document that the key for session encryption must be set securely.

---

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• I don’t see an import for CryptoJS (and encHex) or PBKDF2; you’ll need to import those from ‘crypto-js’ (e.g. CryptoJS and CryptoJS.PBKDF2) or reference CryptoJS.enc.Hex explicitly.
• Pulling SESSION_ENCRYPTION_KEY from process.env couples this module to Node; consider passing the key into SessionManager or the encrypt/decrypt helpers so it works reliably in browser environments and avoids hidden global state.
• 200,000 PBKDF2 iterations on the client may cause noticeable latency—either make the iteration count configurable or switch to the Web Crypto API for better performance.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- I don’t see an import for CryptoJS (and encHex) or PBKDF2; you’ll need to import those from ‘crypto-js’ (e.g. CryptoJS and CryptoJS.PBKDF2) or reference CryptoJS.enc.Hex explicitly.
- Pulling SESSION_ENCRYPTION_KEY from process.env couples this module to Node; consider passing the key into SessionManager or the encrypt/decrypt helpers so it works reliably in browser environments and avoids hidden global state.
- 200,000 PBKDF2 iterations on the client may cause noticeable latency—either make the iteration count configurable or switch to the Web Crypto API for better performance.

## Individual Comments

### Comment 1
<location> `account-kit/signer/src/session/manager.ts:38` </location>
<code_context>
+  const plaintext = JSON.stringify(sessionObj);
+  const salt = CryptoJS.lib.WordArray.random(16);
+  // Derive a key from the password using PBKDF2 with sufficient iterations
+  const key = PBKDF2(keyInput, salt, { keySize: 256 / 32, iterations: 200_000 });
+  const encrypted = CryptoJS.AES.encrypt(plaintext, key).toString();
+  // Store salt (hex) and ciphertext together as "salt:ciphertext"
</code_context>

<issue_to_address>
**suggestion (performance):** High PBKDF2 iteration count may impact performance in browsers.

Benchmark the current iteration count in target browsers and consider using a Web Worker to prevent UI blocking if performance issues arise.

Suggested implementation:

```typescript
/**
 * Benchmarks PBKDF2 performance in the browser.
 * Returns the time in milliseconds for the given iteration count.
 */
function benchmarkPBKDF2(keyInput: string, salt: CryptoJS.lib.WordArray, iterations: number): Promise<number> {
  return new Promise((resolve) => {
    const start = performance.now();
    PBKDF2(keyInput, salt, { keySize: 256 / 32, iterations });
    const end = performance.now();
    resolve(end - start);
  });
}

/**
 * Derives a key using PBKDF2 in a Web Worker to avoid UI blocking.
 * Returns a Promise that resolves to the derived key.
 */
function pbkdf2Worker(keyInput: string, salt: string, iterations: number): Promise<CryptoJS.lib.WordArray> {
  return new Promise((resolve, reject) => {
    // Inline worker code as a string
    const workerCode = `
      self.onmessage = function(e) {
        importScripts('https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js');
        const { keyInput, salt, iterations } = e.data;
        const key = CryptoJS.PBKDF2(keyInput, CryptoJS.enc.Hex.parse(salt), { keySize: 256 / 32, iterations });
        self.postMessage(key.toString(CryptoJS.enc.Hex));
      };
    `;
    const blob = new Blob([workerCode], { type: "application/javascript" });
    const worker = new Worker(URL.createObjectURL(blob));
    worker.onmessage = function(e) {
      const keyHex = e.data;
      resolve(CryptoJS.enc.Hex.parse(keyHex));
      worker.terminate();
    };
    worker.onerror = function(err) {
      reject(err);
      worker.terminate();
    };
    worker.postMessage({ keyInput, salt, iterations });
  });
}

async function encryptSession(sessionObj: object, keyParam?: string): Promise<string> {
  if (!keyParam && !SESSION_ENCRYPTION_KEY) {
    throw new Error("SESSION_ENCRYPTION_KEY must be set!");
  }
  const keyInput = keyParam ?? SESSION_ENCRYPTION_KEY;
  // Use a random salt for each session
  const plaintext = JSON.stringify(sessionObj);
  const salt = CryptoJS.lib.WordArray.random(16);
  const iterations = 200_000;

  // Benchmark PBKDF2 performance
  const pbkdf2Time = await benchmarkPBKDF2(keyInput, salt, iterations);

  let key: CryptoJS.lib.WordArray;
  if (pbkdf2Time > 500) { // If PBKDF2 takes more than 500ms, use Web Worker
    try {
      key = await pbkdf2Worker(keyInput, salt.toString(encHex), iterations);
    } catch (err) {
      // Fallback to synchronous PBKDF2 if worker fails
      key = PBKDF2(keyInput, salt, { keySize: 256 / 32, iterations });
    }
  } else {
    key = PBKDF2(keyInput, salt, { keySize: 256 / 32, iterations });
  }

  const encrypted = CryptoJS.AES.encrypt(plaintext, key).toString();
  // Store salt (hex) and ciphertext together as "salt:ciphertext"
  return salt.toString(encHex) + ':' + encrypted;
}

```

1. The `encryptSession` function is now asynchronous and returns a Promise. You will need to update all callers to use `await encryptSession(...)` or handle the returned Promise.
2. Ensure that `encHex` and `PBKDF2` are properly imported or defined in this file.
3. If you want to avoid loading CryptoJS in the worker from CDN, you can bundle the worker code separately.
4. You may want to expose the benchmark result for logging or telemetry.
</issue_to_address>

### Comment 2
<location> `account-kit/signer/src/session/manager.ts:40-41` </location>
<code_context>
+  const key = PBKDF2(keyInput, salt, { keySize: 256 / 32, iterations: 200_000 });
+  const encrypted = CryptoJS.AES.encrypt(plaintext, key).toString();
+  // Store salt (hex) and ciphertext together as "salt:ciphertext"
+  return salt.toString(encHex) + ':' + encrypted;
+}
+
</code_context>

<issue_to_address>
**issue (typo):** Potential typo: 'encHex' is not defined.

Please update 'encHex' to 'CryptoJS.enc.Hex' to prevent runtime errors.

```suggestion
  // Store salt (hex) and ciphertext together as "salt:ciphertext"
  return salt.toString(CryptoJS.enc.Hex) + ':' + encrypted;
```
</issue_to_address>

### Comment 3
<location> `account-kit/signer/src/session/manager.ts:29` </location>
<code_context>
+// IMPORTANT: Set this key securely through environment/config, not hardcoded.
+const SESSION_ENCRYPTION_KEY = process.env.SESSION_ENCRYPTION_KEY;
+
+function encryptSession(sessionObj: object, keyParam?: string) {
+  if (!keyParam && !SESSION_ENCRYPTION_KEY) {
+    throw new Error("SESSION_ENCRYPTION_KEY must be set!");
</code_context>

<issue_to_address>
**issue (complexity):** Consider moving all cryptographic logic into a separate utility module to keep the session manager focused on session handling.

Consider extracting all the crypto boilerplate into its own module so your session‐manager stays focused on session logic. For example:

1. Create `src/utils/sessionCrypto.ts`:

```ts
import * as CryptoJS from "crypto-js";
import PBKDF2 from "crypto-js/pbkdf2";
import encHex from "crypto-js/enc-hex";

const DEFAULT_ITER = 200_000;
const KEY_SIZE = 256 / 32;

export function encryptSession(
  sessionObj: object,
  keyInput: string
): string {
  const plaintext = JSON.stringify(sessionObj);
  const salt = CryptoJS.lib.WordArray.random(16);
  const key = PBKDF2(keyInput, salt, { keySize: KEY_SIZE, iterations: DEFAULT_ITER });
  const encrypted = CryptoJS.AES.encrypt(plaintext, key).toString();
  return `${salt.toString(encHex)}:${encrypted}`;
}

export function decryptSession(
  data: string,
  keyInput: string
): any | null {
  try {
    const [saltHex, ciphertext] = data.split(":");
    if (!saltHex || !ciphertext) throw new Error("Invalid format");
    const salt = CryptoJS.enc.Hex.parse(saltHex);
    const key = PBKDF2(keyInput, salt, { keySize: KEY_SIZE, iterations: DEFAULT_ITER });
    const bytes = CryptoJS.AES.decrypt(ciphertext, key);
    return JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
  } catch {
    console.warn("Failed to decrypt session");
    return null;
  }
}
```

2. In your session manager file, remove the inline implementations and simply:

```ts
import { encryptSession, decryptSession } from "../utils/sessionCrypto";

// …

public setTemporarySession(session: TemporarySession) {
  const encrypted = encryptSession(session, SESSION_ENCRYPTION_KEY);
  localStorage.setItem(`${this.sessionKey}:temporary`, encrypted);
}

public getTemporarySession(): TemporarySession | null {
  const cipherText = localStorage.getItem(`${this.sessionKey}:temporary`);
  return cipherText
    ? (decryptSession(cipherText, SESSION_ENCRYPTION_KEY) as TemporarySession)
    : null;
}
```

This keeps your manager file ~60 LOC smaller and all crypto‐details isolated.
</issue_to_address>

### Comment 4
<location> `account-kit/signer/src/session/manager.ts:27` </location>
<code_context>
const SESSION_ENCRYPTION_KEY = process.env.SESSION_ENCRYPTION_KEY;

</code_context>

<issue_to_address>
**suggestion (code-quality):** Prefer object destructuring when accessing and using properties. ([`use-object-destructuring`](https://docs.sourcery.ai/Reference/Rules-and-In-Line-Suggestions/TypeScript/Default-Rules/use-object-destructuring))

```suggestion
const {SESSION_ENCRYPTION_KEY} = process.env;
```

<br/><details><summary>Explanation</summary>Object destructuring can often remove an unnecessary temporary reference, as well as making your code more succinct.

From the [Airbnb Javascript Style Guide](https://airbnb.io/javascript/#destructuring--object)
</details>
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}