1

I am currently developing a Dapp in vue.js/node.js which will use MetaMask to interact with the Ethereum Network. I have the following code implemented in a JavaScript module.

 import web3 from 'web3';
 const web3Cont = () => new Promise((resolve) => {
  window.addEventListener('load', () => {
  let currentWeb3;

  if (window.ethereum) {
   currentWeb3 = new web3(window.ethereum);
    try {
     window.ethereum.enable();
      resolve(currentWeb3);
    } catch (error) {
    alert('Please allow access for the app to work');
    }
    } else if (window.web3) {
     window.web3 = new web3(web3.currentProvider);
     resolve(currentWeb3);
    } else {
     alert('You will need MetaMask to use this Site.');
    }   
  });
 });
 export {web3Cont};

I also have the following deployed in a vue.js component:

 mounted () {
  web3Cont().then((res) => {
    this.web3 = res
   if (this.web3.utils) {
   }
   this.contractInstance = new this.web3.eth.Contract(contractAbi, contractAddress)
   this.web3.eth.getAccounts().then((accounts) => {
   [this.account] = accounts
   ...
 })

I did not implement any login nor any cookies functionality, and relying exclusively on the account logged into MetaMask (obtained by the current Provider above) in order to identify the user. Is this tactic secure? Could someone hijack the session somehow and trigger transactions on the Ethereum Network using the hijacked session and MetaMask's Account currently logged in.

Thank you. J

1

It depends on what you do with this information.

  • All information on Ethereum network is public.
  • Any information coming from the client cannot be trusted unless it is signed with a private key
  • If you use this to authenticate against a private server-side database it is not secure
  • All transactions are signed by the wallet any case and then are authenticated on the Ethereum network, so there is no security risk against non-custodial blockchain activities
| improve this answer | |
  • 1
    Thank you for your time and answer Mikko. – JF0001 Jul 1 at 20:42
  • Actually Mikko, I had another question. I understand that all info on the Ethereum Network is public, and all the functionality from my web site will be interacting with the Blockchain. I was asking for I have noticed that sites like Cryptokitties do not ask users to login using other credentials than the Wallet Account. (They do ask for an email, but no password, besides the MetaMask/Wallet one). If all the info is on the blockchain, then it would appear that this scheme is secure, right? – JF0001 Jul 1 at 20:55
  • 1
    Yes. Cryptokitties do not have a backend database or private information for the purpose of the kitties. They might use databases still as a cache though. – Mikko Ohtamaa Jul 1 at 20:57
  • Thank you again Mikko! – JF0001 Jul 1 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.