This is a nice approach, but it is very dangerous! When you fetch the account address from Metamask you can't be sure that it is correct.
Let's have a look at the following code (standard way to get selected account from Metamask - see https://docs.metamask.io/guide/accessing-accounts.html):
<!--
run this file with:
python2 -m SimpleHTTPServer 8000
then open in browser:
http://localhost:8000/scratch.html
-->
<!DOCTYPE html>
<meta content="text/html;charset=utf-8" http-equiv="Content-Type">
<meta content="utf-8" http-equiv="encoding">
<html>
<head>
<title>Selected Account in MetaMask</title>
<link rel="shortcut icon" href="../favicon.ico"/>
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/web3.min.js"></script>
<script>
function logSelectedAddress() {
console.log("logSelectedAddress()\nwindow.ethereum.selectedAddress -> " + window.ethereum.selectedAddress);
}
function changeSelectedAddress() {
window.ethereum.selectedAddress = "0x1234567890123456789012345678901234567890"
console.log("changeSelectedAddress()\nwindow.ethereum.selectedAddress -> " + window.ethereum.selectedAddress);
}
</script>
</head>
<body>
<button onclick="logSelectedAddress()">Load Address from Metamask</button>
<button onclick="changeSelectedAddress()">Change Address</button>
</body>
</html>
- Run this file with: python2 -m SimpleHTTPServer 8000
- Open in browser: http://localhost:8000/scratch.html
- Load the page and connect to your Metamask account
- Press button "Load Address from Metamask"
- Press button "Change Address"
- Press button "Load Address from Metamask"
The expected result in your browser:
Conclusion
Till step (4) everything looks ok, but then the code executed in step (5) overwrites the selected account. This could happen in the console or with a cross site scripting (XSS). So, everyone can pretend to have each possible account.
The only secure way would be to sign and execute a transaction with this account, but here we have considerable costs with every authentication.
