How to validate signed message from backend C# application

Question

I'm new to blockchain development and looking for some directions.

I have an existing single page application that uses Metamask to login (i.e. sign a custom message). The APP needs to call an API (written in c# on .net 6) and the API must authorize the user based wallet ID.

The idea is:

• the user signs a message containing the wallet ID + a nonce generated by the API
• the client APP sends the message to the API
• the API validates that the signed message has not been tampered, extracts the nonce + wallet ID and compares the nonce value with the previously sent one

Does it makes sense? What sdk/libraries can I use to implement the API portion of this scenario?

Answer 1

Yes, your approach makes sense. Here are a few steps you can follow to implement the API portion of your scenario:

1. Use the web3.eth.personal.sign method in your client-side JavaScript code to sign the message containing the wallet ID and nonce. This method is part of the Web3.js library, which you can use to interact with the Ethereum blockchain from your client-side code.

2. When the user signs the message, the web3.eth.personal.sign method will return the signed message as a hexadecimal string. You can then send this signed message to your API using an HTTP request.

3. In your API, use the web3.eth.personal.ecRecover method to recover the wallet address from the signed message. This method is part of the Web3.js library and allows you to verify that the signed message has not been tampered with and was indeed signed by the wallet address that it claims to be from.

4. Once you have recovered the wallet address, you can extract the nonce and wallet ID from the signed message and compare them to the values you sent to the client-side code. If the nonce and wallet ID match, you can consider the user to be authorized.

To implement your API, you can use any server-side language that is compatible with the Web3.js library. Some popular options include Node.js, Python, and Java. You can also use the Web3.NET library to interact with the Ethereum blockchain from a .NET application.