Skip to content

Latest commit

 

History

History
41 lines (31 loc) · 1017 Bytes

README.md

File metadata and controls

41 lines (31 loc) · 1017 Bytes

Auth Flow

User has wallet which contains user's privateKey.

Fact#1

Private key can be used to sign a msg and then verify the msg!

Fact#2

Public address of private key can be derived signed msg by comparing signed msg hash and original msg

Fact#3

Browser can create a random password and then use it as a starting point for sign-up

Fact#4

Browser Can hold a session (jwt-token) generated by server and ask for refresh when ever needed

Fact#5

Jwt Token has two fixed expiry times; one for resource usage and two to refresh token. This can tell server wether user is online or inactive or offline ....

Fact#6

This approach has no forgot password approach :)

User Sign Up

  • Generate a random password
  • Store Password in browser
  • Connect Wallet
  • Ask for a msg from server
  • Sign a msg
  • Post Signed msg
  • Server Responds with Session token (JWT)
  • Store Session
  • [FUTURE]
    • Ouath / Email / other methods
    • Add Password Recovery
  • Done !

Samples

MSG = uuid.New()