I'm making a dapp that will make calls to a Node.js server. I expect the user to have MetaMask installed and I want to verify that he is the real owner of the current address on MetaMask (i.e.
This is the user flow I am trying to implement:
- User loads up my dapp frontend in his browser.
- The browser gets
- The frontend requests some data specific to
accountsfrom my Node.js API.
- On the Node.js server, I need to verify that the request is coming from someone who actually owns the private keys to the address
accounts. If this is valid, then I respond with the specific data.
I spent a long time looking at different signing functions with Web3, and I ended up very confused. There is:
web3.eth.sign- there's no
recovercounterpart to this and MetaMask doesn't pop up asking the user to sign something.
web3.eth.personal.sign- this one requires a password, I don't want to ask the user to enter his password, shouldn't MetaMask do this?
web3.eth.accounts.sign- this seems more like a hashing function than what I need.
I have a feeling that none of the three above functions are what I need. Can someone provide some guidance on how to approach this?