Is it possible to validate the Metamask personal_sign in the back end?

Question

I am trying to understand the point of signing a personal message in the client. I guess this is usefull to confirm that the user is the owner of the address. But since this sign is done in the client we need a way to confirm in the backend that the message has been signed with the correct address. Is this possible with ethers.js?

Answer 1

I've implemented this. What you can do is, in an API send user address to the backend and get a signature message from backend. Something like "Sign this message: <any random string>"

Then in frontend sign that message and you'll get back a signature, send that signature back to backend and verify. If signature is correct generate jwt.

Answer 2

This is an example in javascript and nodejs to solve this.

// Client javascript
const message = "My Message";
const address = '0x2e1fe3c3bf4c576d34c4048e5e7a8055b92a2e21';
const message_hex = `0x${Buffer.from(message, "utf8").toString("hex")}`;
const message_signed = await ethereum.request({
    method: "personal_sign",
    params: [message_hex, from],
})

// Server node.js
const { ethers } = require('ethers')
const address_returned = ethers.verifyMessage(message, message_signed)
console.log(address.toLowerCase()===address_returned.toLowerCase())