Authenticate transaction in Web3.js application with password

Question

I have a simple web3.js based app and like to call a method from an contract.

For this method an authenticaten is needed. I found some examples in the web using web3.eth.accounts.signTransaction But in this case, I need the private key.

Waht I need is something like web3.eth.personal.unlockAccount, which unlock the account not for an time range, but for the transaction only.

Is this possible?

Answer 1

Your dApp users use a wallet like MetaMask that will do this for your dApp:

https://github.com/MetaMask/faq/blob/master/DEVELOPERS.md

Answer 2

You could use BatchRequests to unlock, send a transaction, and then lock your account. You can see lockAccount at the bottom of the personal section under TODO, it is implemented just not documented.

I believe that this still opens up a window of opportunity for someone else to hit the API and send a transaction that you don't want, but it is at least tiny.

I'd recommend not using your Ethereum node to handle private keys. Possibly create an intermediate proxy service if you don't trust the frontend user.