When using web3.js to execute a function in a contract, I always get the following error: "authentication needed: password or unlock." I know that I have to unlock account first via either geth console or web3.personal.unlockAccount(web3.personal.listAccounts,"", duration). However, it is not convenient to use console when the smart contract executes in the real network. Moreover, I am not comfortable to use web3.personal.unlockAccount because I have to provide the password of the account in the clear text. So, what is the best way to unlock account programmatically while still keeping the password secret?
You have a few options on how to obscure your password:
1) one simple way is I save a temp variable and clear my screen in console:
pw = ‘myPassword’;
control+k // clear screen
Then I can unlock and take my time with unlocking:
2) you can obscure it my creating your own UI to input the password and conceal it:
<input type=“password” />
After you handle this input according to your preferred method of UI, then you need to do a bit more manual work of signing the raw transaction and sending it. You need to use a library like ethereumjs-tx.
You’d need to convert the function call into hex data, sign it with ethereumjs-tx, and then send the transaction with that signed data to the Blockchain. So a few more steps here.
3) You can use Metamask, and the signing is done through that. You’d need a Metamask enabled chrome browser, your accounts in that Metamask vault, and you’d need to use the Metamask-injected web3 and call the contract function through that.
4) You can use an app with a web3 browser like Mist or Parity; open your web app through their built in browsers, then you can sign through those apps.