Would it be feasible to contract access to a web resource based on whether the Metamask wallet connected to the web client owns an NFT of a certain kind?
For example, I have a video hosted somewhere, password-protected, and I can call an API on my video host to create a password for the video on the fly. And I would like to use that to control access to that video based on whether the wallet accessing the page owns an ERC721 token of a certain kind.
I was thinking of something like:
- client sends wallet address to server
- server checks ownership of token
- if wallet owns token, server generates a session-specific password with a given expiration and sets it in a cookie or something like that to initiate a session
- client can use that password to load the video
- next time he comes back, we check the cookie, and if the cookie expired we restart the process, otherwise direct access
Is that possible? Is there an easier way to implement something like a Pay-per-view system like that? Are there attack vectors I'm not seeing?