joinmarket-webui / joinmarket-webui/jam

fix(settings): clear cached seed phrase after timeout

Open
#1,449 0 comments 0 reactions 1 assignee Claimed by @parrth20 View on GitHub
bug security SoB
Dominant language
TypeScript
Stars
330
Forks
122
Avg merge
2d 17h
Merged PRs (30d)
17

Description

### Problem

The seed phrase dialog hides the seed after its timeout, but the seed remains in React Query's cache because the cache is only cleared when the dialog is closed.

The `revealSeed` state is also not reset. If the seed was revealed before timeout, verifying the password again without closing the dialog shows the cached seed immediately and still unmasked.

### Steps to reproduce

1. Open Settings and select **Show seed phrase**.
2. Verify the wallet password.
3. Reveal the seed phrase.
4. Wait for the countdown to expire.
5. Verify the password again without closing the dialog.

### Actual behavior

The cached seed phrase is displayed immediately and remains revealed.

### Expected behavior

When the timeout expires:

- remove the seed phrase from the query cache
- reset the reveal state
- require the seed phrase to be fetched again after verification
- show the phrase masked by default

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.