I think it's doable. If relay supports it, it can keep a session_id -> expiration_date table easily and if you answer the AUTH with a session_id, it can check and accept or reject. You can still decide to sign the challenge and receive a new session_id.
If the relay gets hacked and session_id is stolen, the damage is very little IMO
dhalsim
npub1de…05uc4
2026-07-14 22:46:31 UTC
in reply to nevent1q…ezxj
Author Public Key
npub1dejts0qlva8mqzjlrxqkc2tmvs2t7elszky5upxaf3jha9qs9m5q605uc4Seen on
wss://nostr.momPublished at
2026-07-14 22:46:31 UTCEvent JSON
{
"id": "83427b5cf46d672e8624a361c0b3d5bca1f8c2941b12da220c4cecdc8909eea3",
"pubkey": "6e64b83c1f674fb00a5f19816c297b6414bf67f015894e04dd4c657e94102ee8",
"created_at": 1784069191,
"kind": 1,
"tags": [
[
"e",
"3e56fbcb2c546074ea576e0d197864e5c38e745403ae2db4528c821273d23599",
"wss://relay.damus.io/",
"root",
"266815e0c9210dfa324c6cba3573b14bee49da4209a9456f9484e5106cd408a5"
],
[
"p",
"266815e0c9210dfa324c6cba3573b14bee49da4209a9456f9484e5106cd408a5"
],
[
"k",
"1"
]
],
"content": "I think it's doable. If relay supports it, it can keep a session_id -\u003e expiration_date table easily and if you answer the AUTH with a session_id, it can check and accept or reject. You can still decide to sign the challenge and receive a new session_id.\n\nIf the relay gets hacked and session_id is stolen, the damage is very little IMO",
"sig": "7fd61bf2bfad5110e8a7f03faeae89e1c6d810d7c989a0766ce5336c8e6fbd9940ad2b61144d06028c0416bb99d80958a8e9dda90795bec8cae99bda967911a5"
}