I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this:
The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an HTTP (or WebSocket) server on it.
The smart phone connects to the access point and sends a GET request, then the lock opens (or the phone sends some string in the case of WebSocket).
The questions are: Since I am always doing the same operation exactly the same, can someone sniff the packets sent and perform a replay attack?
As far as I know, the encryption key changes each session, but what if I am still connected to the network? Can someone then pretend to be me?
Are there any countermeasures done in Wi-Fi networks?