Walletconnect backend user authentication

post by Leo1707 on Mar 6, 2022

Hi,

I’m struggling to find a way to authenticate the users using walletconnect.

On the client side everything works fine, the user can login using the qrcode.

The problem is the backend, I wanna create a database with some data of the users (user public key → data), but in order to return the data I have to be sure that the user it’s really him.

I thought that I can fix it by using a push notification to the server when the user logged using walletconnect but it only return a “topic”: . and not the user public key.

So what’s the way to get a secure authentication from the server side?

Thanks in advance!
Leonardo

post by scholtz on Mar 6, 2022

Hi @Leo1707

check this standard - ARC-0014 - Algorand Standard for authentication: Discussion for ARC-0014 - Algorand Standard for authentication · Issue #42 · algorandfoundation/ARCs · GitHub

implemented in .net NuGet Gallery | AlgorandAuthentication 1.0.0 … open source here GitHub - scholtz/AlgorandAuthenticationDotNet

used for example at www.globdrem.com

what language do you use for your backend?

post by Leo1707 on Mar 6, 2022

I’m using typescript, with express.

Thanks a lot for the quick reply!!! I’ll try to make it works in the following days and ask if I got stuck again.

Have a nice evening,
Leonardo

post by Leo1707 on Mar 7, 2022

I’m just having a small question about this method, when it’s asked to the user to sign the zero transaction, it create a popup in the wallet application and the user need to confirm the zero transaction there, or it’s just something in the dApp?

It can be annoying to the user to sign the zero transaction every time he enter in the application.

Or there is a way to doit just once and then the following times there is a different method?

Then I’m having a second questions about the walletconnect push server ( link). The push notification it’s trigger from the wallet, the bridge server or the dApp? It’s not clear from the image ( link).

Because I’m thinking that if the notification come from the wallet or the bridge server, it can be secure and reliable, form the dapp someone could change the code and send whatever likes.

I’m sorry if the technical details are not accurate,

Thanks a lot