1

I am trying to build new Dapp application for our startup by using web3j , I am facing an issue with signing the transaction from server side , because i need to know the private key for the client (wallet) and it's not best practices to send the the private key over the network .

So the question is : Did anyone solve this issue , or I should keep all the code in frontend-side ?

  • If it's you who initiates the transaction, and this transaction should occur periodically (and relatively often), then you pretty much don't have a choice, and must run it from a server. There are ways to keep a private key relatively secured on server side, for example, Amazon's KMS. If it's your users who initiate the transaction, then you can encrypt every user's private key on client side (using the user's password), send it encrypted to be stored on your server, and send it to client side when the user wishes to sign a transaction. – goodvibration Apr 15 at 10:34
  • 1
    Do you really need to know the client's private key? If so it is not the client's private key. The issue is not really with sending a key over the network, which is not a problem with https, it's the separation of privilage between you and your client. – Tjaden Hess Apr 15 at 14:08
1

As Tjaden says:

Do you really need to know the client's private key? If so it is not the client's private key. The issue is not really with sending a key over the network, which is not a problem with https, it's the separation of privilage between you and your client.

The clients have their own signing keys which they should not give up under any circumstances. The server should possibly have one or more signing keys of its own.

The server should not attempt to impersonate a client and should not ask for their signing keys, in my opinion. You can have the server do things for the clients or about the clients or to the clients, but not as the clients.

Consider this sketch of a function for the privileged server to do something on behalf of a client. The client is expected to be an important topic, but is not expected to sign.

function privilegedAction(address onBehalfOf) public onlyOwner {
  // use onBehalfOf instead of msg.sender to get things done. 
}

onlyOwner restricts who can use the function. The addressed passed in means there is no need to ask the user for a private key.

This makes the priviliged functions that the server/owner will be allowed to do very clear, and also makes it very clear that the server is not privileged in other cases where msg.sender is used.

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.