I'm trying to use web3 1.0 to authenticate users on a web server. Instead of having unauthenticated users submit a username and password, I want them to send their address (public key). I'll respond with a random message for them to sign, then use
web3.eth.personal.ecRecover (server-side) to verify the signature came from the same address before returning a cookie for the session.
- Does this approach make sense? Am I reinventing the wheel?
web3.eth.personal.[sign|ecRecover]the pair of functions I should actually use? There are also
web3.eth.accounts.recover. Looking at the web3 source code,
web3.eth.accounts.recovermight be an even better option to use on the server-side because it doesn't need to contact an ethereum node.