We are planning to have some of the smart contract functionality available to external users, but only if they go via our website. (Eventually, they will be accessible via usual contract calls directly on the blockchain). So workflow is like this -> User-logs into our website - provides some information that we can validate against external sources - once validated, we invoke the corresponding smart contract functionality from the backend.
While I can use web3.js to call out from my website to the blockchain, how exactly would my account/wallet be secured by the website itself? As in, if our website is hosted on aws, should we have the secret key stored in our db and use it to sign our calls to the block chain? Or, is the only option to use mist/metamask from a locally secured computer to call the restricted external functions on the contract?
If anyone has done something similar, it would be great if you could share the list of tools you have used to secure and the list of tools you used to access the block chain.
Any thoughts on how multi-people organizations can effectively and securely handle access to smart contracts is also appreciated.