1

I'm just getting started with Ethereum. To understand the platform better, I intend to build a web interface for a voting contract.

User should be able to make authenticated transactions to vote on a private blockchain. What is best way to achieve this?

Background: I have looked at truffle as an option, but I could not find a way to carry out an authenticated transaction using the web interface.

Update: From what I understand, an Ethereum wallet can unlock an account (accept a passphrase to decrypt the private key) and send transactions on behalf of the unlocked account (sign transactions with the private key). I'm looking for a way for users to be able to send transactions to the blockchain using a web interface. I believe this possible with truffle, but not sure how.

|improve this question
2

Private blockchain means it's permissioned and you need to authenticate your users somehow.

The easiest way to run a private blockchain with a web interface is

  • Run a private Ethereum node in private network

  • Have a web server on DMZ (demilitarized zone) listening port HTTPS 443 to a public internet

  • Make your web server act as an authenticating proxy and only pass through JSON-RPC traffic for an authenticated users - only properly authenticated traffic is proxied into the private network

  • You do not need to use Geth or Parity account feature; just generate a private key to all users on the client side and sign all transactions on a client side. This way the only state changing API you need to expose is eth_sendRawTransaction

Here is an example how to do this with Nginx web server:

https://tokenmarket.net/blog/protecting-ethereum-json-rpc-api-with-password/

|improve this answer
  • Looks like eth_sendrawTransaction is what I was looking for. Thanks :) – Omkar Khair Mar 13 '17 at 10:06
1

I'm not sure if this is "on-point" re: "authenticated transaction" but I'm going with a novice concept since you say you're new.

We can say that all transactions are "authenticated" in the sense that all transactions originate from an Ethereum wallet. You can safely use the msg.sender to get an address that represents the address that called function/sent message/sent transaction.

A very nice feature of the Ethereum protocol is user's can't send transactions without knowledge of the private key. Most authentication situations are surprisingly trivial. 

address userAddress = msg.sender; // this address is "authenticated".

Please let me know if that's helpful or if I missed the gist of the question.

|improve this answer
  • You partially answer my question. Understand from this, that accounts unlocked on a wallet can send signed transactions to the blockchain (correct me if I am wrong here). The signature itself marks the authenticity of the transaction. But is it possible for users to send a signed transaction over RPC endpoint? Possibly unlock their account on a RPC node, and carry out transactions? – Omkar Khair Mar 12 '17 at 18:08
  • 1
    There's a separation of concerns. Yes, it's possible to mismanage client-side security in a such a way that secrets are compromised. msg.sender is as tight (but no more tight) than the rules governing spending. If the user can "spend" then it can "send" (vote, in your case) - same requirements/same risks. Your contract only needs to focus on who voted, or who is allowed to vote. As far as sensitive privileges are concerned, a common pattern is to have a contract "owner". "Owner" might be a human, or it might be a quorum contract, or something else. We can externalize that concern. – Rob Hitchens - B9lab Mar 12 '17 at 19:23
  • Thanks for all the helpful information Rob. sendRawTransaction solves the problem. I can then accept pre-signed transactions from users to vote, and relay it through my webservice. – Omkar Khair Mar 13 '17 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.