What is the best practice for users to securely send a POST to an API with their Ethereum address? My inclination is to have the user sign a message with their private key, send the resulting signature to the backend, and recover the public key on the backend using the same message and signature.
Most importantly, is this flow (1) correct and (2) secure? I assume signatures cannot be faked without knowing some private key. The API would be public, and the signature used in lieu of JWTs as the only means of authentication.
Secondly, if the above is correct and secure, what are the recommended methods to have users sign transactions? I see 3 methods of signing transactions in Web3.js with unclear differences between them:
web3.eth.sign(dataToSign, address [, callback])
web3.eth.personal.sign(dataToSign, address, password [, callback])
web3.eth.accounts.sign(data, privateKey);(Client would obviously not have
And 1 method to recover the account that signed the data:
web3.eth.personal.ecRecover(dataThatWasSigned, signature [, callback])
Which methods are recommended and why?
Lastly, is the message itself important? I assume it can be anything as long as the backend and client have the same one, but users should also feel confident that signing a given message cannot be used nefariously.