Online users become especially resistant to traditional processes of registration of a mailbox/password. Social entrances to a single click through facebook, google or github are cooler, but they are made with compromises of data privacy. , With all the data stored at their opposite end. Mobile (node.Js, react, react native), and in addition, the development of blockchain programs.

Expertise

Years of experience

12

Visitors, the internet is still becoming stronger to traditional email/password registration processes. The functionality of social hacking in one click through facebook, google or github is a much more desirable alternative. However, he comes with a compromise. You should learn another couple of users/password. - Because the user’s base is loaded from external suppliers, this causes an unresolved difficulty in confidentiality in how suppliers use all this personal information. For example, the process of writing facebook is faced with the difficulties of data privacy. Expansion, with the whole world, data stored here on their own rear. We call this: "enter metamask."

The picture costs thousands of words, here is a demonstration of the input flow, which we are going to build:

it looks good? You can start! Web-based crypto wallet The account by signing part of the information using the closed key. If you manage to sign the exact part of the information generated by our backing, then the rear end will consider you the owner of such a public address. That is why we can create an authentication mechanism created for notifications with a public address of the user in the role of their identifier. This is bito-bit:

Expansion of the metamask browser, how does the opening flow of the opening flow operate on the opening of the system is ready today disadvantages on the phone

We remind you that despite the fact that we will use the tools connected to the ethereum blockchain (metamask, ethereum public aderes), this entry process does not actually have the need for blockchain: this is only necessary for such cryptographic functions. At the same time, if metamask becomes such a popular expansion, now it seems a good time to introduce this entrance flow. Believe me, there is metamask, do not hesitate to miss this sector. At its core, it serves the ethereum wallet: by installing it, you will get the entrance to the unique public address of ethereum, with which you can start sending and receiving ether or tokens.

But metamask wallet makes an ethereum wallet not a typical wallet. As an expansion of a browser, it can be combined with a current web page, in this case you open. This is carried out thanks to the addition of the javascript library called web3.Js on each web page, then you visit. After introduction, the web3 object will be available through window.Web3 in the javascript code of this web resource. To see how this object looks like, just designate window.Web3 in the chrome or firefox devtools console, since you have metamask. Metamask also introduces a global api in window.Ethereum, and a private closed key of the metamask api is possible from the expansion of the browser through the account information button.

Web3 blockchain. There are functions:

- Get the last chain block (web3>- get a balance of any account (web3.Eth.Getbalace) - send transactions (web3.Eth.Sendtransaction)@>->->->- ... And very more

When metamask is installed, any frontal code can request admission to all these functions and joke with the blockchain. They are called dapps or dapps (for decentralized applications, they sometimes even stylish đapps) .

Most functions in web3 web3 will answer immediately. However, some functions (like web3.Eth.Sendtransaction and web3.Personal.Sign) need current accounting registration to sign some information with zodiac closed the key. These functions are launched by metamask in order to show the confirmation screen in order to find out twice that the visitor of the internet knows what she is or he signs. In order to arrange a simple test, insert the next line in the devtools console:

This command means: sign my message, converted from utf8 to hex, with the coinbase accounting record (i.E. The current account) and and as a reverse call, print the signature. A popamask window will appear, in the case you sign it will be printed by the signed message.

The last note about this section: metamask introduces web3.Js into your current browser, but in reality there are, and other individual browsers that also introduce web3.Js, for example, fog.However, in my opinion, metamask today offers the best ux and the easiest transition for average citizens to search for dapps.

How the flow of visits to the system works how. How do we hope if you convince you that it is safe, wanting to help, i will leave why partially. There is a traditional architecture for the web 2.0 client-server. We will make one assumption: that any users visiting our interface web page were installed by metamask. With the assumption, we will imagine how the cryptographic flow of the entrance to the system is valid, without a password. In addition, publicaddress should be unique. You have the opportunity to save ordinary user, electrical and password fields, all the more, if you want to sell your choice in metamas a little different, since publicaddress will be a necessary field when registering if the user wants to use the metamask login. Be sure, the user will never be worth printing his publicaddress manually, since pink flowers can be obtained through web3 fields. For example, nonce can be a large random whole.

In the daily javascript interface code, assuming that metamask is present, our store has access to window.Web3. Therefore, we can call web3.Eth.Coinbase to get a publicly accessible address of the current metamask account. Associated with their public address. Something like a route with a get /api /users filter parameter? Publicaddress = $ publicaddress introduces. Of course, since this is a non -automated api call, the rear end should be configured to demonstrate only public information (including nonce) on this route. This means that the current public address has not yet subscribed. We should first post a new account through post /users, transmitting publicaddress in the request penis. On the other hand, if there was a result, then at home-ot-mikhalych.Rf we keep it nonce.

, After the front end receives nonce to rebuke the previous call of the api, it activates the following code:

This suggests metamask to display a pop -up confirmation window for signing a message. Nonce will be displayed in a real pop -up window so that the player is in charge that she or he does not sign some malicious data. Signed message (called signature) as an argument. The front end then then makes another call api to post/api/authentication, transmitting the body with both the signature and publicaddress. A person in a database corresponding to publicaddress given in the request body. In particular, he receives a nonce related to this.

Having a nonsense, a public place and signature, the rear end can then cryptographically confirm that nonce was correctly signed by the user. If it is like this, then the user has proved the ownership of the public site and our company can consider it or its authentication. The jwt or session identifier is possible to the front part. Time, the same visitor wants to go into the system, she or he will like to sign a new nonka. This is possible by generating a re -random non -random user for this and leaving it in the database.

Et voilà! There, how we control the pipe that cannot be signed, without a password.

Why is the flow of the logbook. If you are very seriously identifying your account using a public address, then cryptographically trivially prove that the victim has it. And not your actual closed key), we use the message to sign in order to remain:

1. Reported by the rear end and 2. Regularly change

We changed it later than each successful access to a modern explanation, but we could imagine a mechanism based on times. >

In it i will pass six steps higher, in turn. I will show a few fragments of the code for how people can build this opening stream of the system again, or integrate it, in the existing rear end, with ease.

I created a small demonstration addition to the goal of this article. The stack that i use is as follows:

- Node.Js, express and sqlite (through sevelize orm) for restful api at the rear end. He returns jwt for successful authentication. I believe that the code is extremely simple so that you can translate education into other current stacks. A demo is placed here. We initialize nonce as an accidental huge number. This fact, the quantity must be changed after each successful opening into the system. I also added an additional user field here, which the user will be able to change. A more severe implementation would add a check function to check that any films of the links here are valid ethereum addresses.

Step 2: to generate nonces (back-end)

This is done in the defaultvalue () in clarification of the model above.

Step 3: this is to add a little code of the template code to the background if you need to process crud methods for a user girl that we will not do here. The visit to the system, our handleclick handler performs the following:

Here, we accept the active accounting of metamask using web3.Eth.Coinbase. Next, the commission check if this publicaddress is or not in the background. We either get it if the user already exists, or if not, we create a new account in the handlesignup method. >

Let's move forward in the everyday method of handleclick. Today we have at our disposal of the user provided by the backing end (whether it is received or newly created). Specifically, we have them nere and publicaddress. Therefore, we will be happy to sign nonce with a closed key associated with this publicaddress on the web3.Personal.Sign. This is done in the handlesignmessage functions. It is useful for us to convert our utf-8 line, encoded to a hexadecimal format using web3.Fromutf8. Moreover, in return, in order to sign only nonce, i decided to sign a more convenient sentence, as this will be displayed in the pop -up window of confirmation of metamask: i sign my once nonce: $ nonce.

When the user successfully signed the message, we move to the handleauthenticate method. We really send an application to the route /auth in the background, private label crypto wallet sending our publicaddress, as well as the signature of the message that the user recently signed.

Step 5: checking the signature (back time)

This is a slightly more complex part. The back receives an order on the route /auth containing publicaddress and the signature, and it is necessary to check if this publicadress signed the correct nonce.

Starting stage - remove from the information base. User with a given publicaddress; there are only one, due to the fact that we have defined publicaddress as a unique field in the database. Then the commission set the msg message how i sign my ... ”, Just like at the front end in step 4, with this user process. There is a certain cryptography. In the event that you feel the adventure, i will give advice to you to read more about the elliptical curve signatures. The public address is needed for the msg signature. If it corresponds to our publicaddress from the request authority, then the person who made a request has successfully proved his ownership of publicaddress. We think their authentication. This is a traditional authentication scheme, and the jwt integration code with your rear conclusion you have the opportunity to look at the repo. @>

The last step is to change nonce, for security reasons. Somewhere after successful authentication, add this code:

This was not so complicated, wasn't it? In addition, in the case when you will meet how the entire application is connected (the generation of jwt, crud routes, local storage, etc.), Do not forget to look at the repo github.

Today he is ready to the production

, While the blockchain gets the opportunity to have its shortcomings and is still at the infant stage, i can’t emphasize how such an entrance happens to all existing resources today. Here is a list of arguments why this entrance flow is preferable to the email, as well as in social entrances:

- Increased safety: confirmation of ownership of the owner by encryption with a public key is possible, which is non-hazardous than a guarantee of rights real estate for email/password or from a third person, a wider circle, because metamask stores the accounting data locally on your laptop, but not on online servers, which makes the surface of the attack smaller. Well, two clicks happen) an access stream made in a matter of seconds, without printing or remembering any password. >

Of course, the opening flow there metamask is perfectly used in parallel with other usual ways to visit the system. Between each account and a public address (es), a display should be made. Users must install metamask: this opening stream of the system obviously does not function without metamask or browser via web3. If your audience is not striving in cryptocurrencies, there is a small risk that they will solve the task of installing metamask. With a recent crypto-boom, we will wait for our confectioners to go to the web 3.0 network. Admission to the system. However, in order to integrate it into an existing complex system, this requires some changes in almost all areas that applies to authentication: registration, database, authentication routes, etc. This is most true, because each account will be associated with one or more public addresses. - The holder does not work on a smartphone: it deserves his own section. It is a legal marker for such an entrance flow. In browsers of desktop computers, metamask introduces it.Nevertheless, there are no extensions on mobile browsers, so this entrance flow will not work without a box on mobile safari, chrome or firefox. There are a number of autonomous mobile browsers that introduce the web-3-bazaic metamascus wrapped in a browser. In the process of writing this article, they are very early stages, but if you liked it, look at the cipher, status and tosha. “Enter with metamask” works with these mobile browsers. In fact, you want to independently restore the simple ethereum wallet. This contains the generation of public addresses, the restoration of seeds and the safe storage of private keys, and besides this web3.Personal.Sign and a pop -up confirmation window. It’s good that there are libraries that help. The most important area on which you can concentrate is undoubtedly considered naturally security, since the application itself boasts its key. In browsers for desktop computers, we delegated this issue in metamask. Efforts are directed in this area, but a simple solution in the 3rd millennium remains a parallel traditional entry method for: user cell phones.

Let your users be in practice with metamask

We entered in the proposed publication, a cryptographic-worn flow of entering one click, without the participation of a third person called " connect with metamask. " We explained how the digital signature of the rear end of the random nonse is able to say the right to own account and therefore ensure the authentication of web3. In addition, we have investigated the compromises of this hacking mechanism into the system to competitors with traditional emails/passwords or social entrances, how on the desktop, similarly on mobile small ones, i am sincerely convinced that some customer will be inspired to give the entrance to metamask in a certain web application, at the same time with the usual flows of entering the system, and i had the intention to hear about it when you do this. If in the tablet there are any transactions do not hesitate to contact the reviews below.

Share this Story