I am using Infura as a node for my DApp so I need to send raw transactions by signing them. These transactions can come from multiple users of an application so each user must sign and send a raw transaction to infura.
One solution would be take the private key as input from user during signup and securely store it somewhere for future transactions. This sounds like an insecure way and a lot of work.
Afaik the easiest and one of the safest ways to do this is get access to the account from metamask on the client instead of managing private keys of multiple users in my application.
If I'm using the second approach, I don't wanna put the logic of signing and doing transactions on the client, I need to transmit the private key to the server so that it will sign the transaction. How can I achieve this? Is there a safe solution to this?
- Should I put all the blockchain logic in the client and update my database in the server code when successful? (I don't personally like this)
- Most acceptable approach that I can think of is to sign the transaction using web3.personal.sign() on the client and then send the signed transaction to the server where the server calls web3.eth.sendSignedTransaction() to make the transaction.
How are the real DApps doing this with metamask integration?
I wanna rephrase this question since there is no straight forward anaswer here so far. The question would be:
What is the easiest way to sign transactions on user's behalf from the server without hardcoding their private keys? Any solution with or without Metamask would do.