I'm trying to use web3 1.0 to authenticate users on a web server. Instead of having unauthenticated users submit a username and password, I want them to send their address (public key). I'll respond with a random message for them to sign, then use web3.eth.personal.ecRecover (server-side) to verify the signature came from the same address before returning a cookie for the session.

Two questions:

  1. Does this approach make sense? Am I reinventing the wheel?
  2. Is web3.eth.personal.[sign|ecRecover] the pair of functions I should actually use? There are also web3.eth.sign, web3.eth.accounts.sign and web3.eth.accounts.recover. Looking at the web3 source code, web3.eth.accounts.recover might be an even better option to use on the server-side because it doesn't need to contact an ethereum node.