Unlocking accounts for a back office app

Question

I'm writing a "back office" app and need a way to unlock an account in an automated fashion.

Yes, I know security of nodejs is questionable, but there are ways of solving this. blocking web3 from doing this at all doesn't seem like a comprehensive solution.

The current answer says "use a browser/mist" because they have an browser based API to do so, but that's not acceptable for a back office app written in nodejs (or python, or ...). So what is a good answer?

web3 doesn't support this API according to a related answer.

This answer will also be needed for something like a split key unlock (e.g. like some of the newer bitcoin wallets). I'd actually prefer an n-way split key unlock for my use anyways. Hmm, can we write a smart contract for this?...

Answer 1

It seems like you are asking 'how can I create a contract which users can use as an account but which can be locked and unlocked by server-side calls?'.

The Mist multisig wallet code is available here it runs independently of Mist and can be called like any regular contract. You could adapt this contract code to suit your application case then call this contract from nodejs (using web3 as a server side module) or other languages (using other json-rpc or IPC libraries)

Answer 2

I've just answered a related question in How to unlock accounts programmatically after the node has started? .

The solution in the question above uses geth's IPC API that communicates through a file socket like /home/user/.ethereum/geth.ipc .

You may have to use geth's RPC API that communicates through the TCP/IP protocol. In this case, you will have to add personal to the --rpcapi parameter. The relevant geth --help is shown below:

API AND CONSOLE OPTIONS:
  --rpc                                 Enable the HTTP-RPC server
  --rpcaddr "127.0.0.1"                         HTTP-RPC server listening interface
  --rpcport "8545"                          HTTP-RPC server listening port
  --rpcapi "db,eth,net,web3"                        API's offered over the HTTP-RPC interface
  --ipcdisable                              Disable the IPC-RPC server
  --ipcapi "admin,db,eth,debug,miner,net,shh,txpool,personal,web3"  API's offered over the IPC-RPC interface
  --ipcpath "/home/user/.ethereum/geth.ipc"             Filename for IPC socket/pipe
  --rpccorsdomain                           Domains from which to accept cross origin requests (browser enforced)
  --jspath "."                              JavaSript root path for `loadScript` and document root for `admin.httpGet`
  --exec                                Execute JavaScript statement (only in combination with console/attach)