3

On my site I do not want to use email/pass authorization, but insteand I'd like to use Metamask sign functionality (it is impossible to work with site without Metamask or browser with web3).

I suppose to implement something like this:

  • client generates any random string/pin code.
  • on "login" click sign it and sends alongside with pincode to server (I know that I can use any static phrase and it doesn't increases overall security).
  • there signature checked and public key/address derived.
  • if user with such public key/address found - generate standard JWT and use it with all following REST requests.

I am wondering is it safe enough or I missed something important?

  • looking for similar I found this, not sure if quite what you need but helpful: hackernoon.com/… – majick May 10 '18 at 23:19
  • @majick thanks, I already implemented it and cannot see any security cons in this approach. – Alex G.P. May 11 '18 at 3:58
  • certainly looks like the way to go, any tips or code you can share? this is totally not my area of expertise (yet.) – majick May 17 '18 at 13:49
1

This has been done multiple times, but this is one that really goes into details on it

https://www.toptal.com/ethereum/one-click-login-flows-a-metamask-tutorial

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.