以太坊上的身分驗證

example.com wants you to sign in with your Ethereum account:
0xAb5801a7D398351b8bE11C439e05C5B3259aeC9B

I accept the Terms of Service: https://example.com/tos

URI: https://example.com/login
Version: 1
Chain ID: 1
Nonce: 32891757
Issued At: 2024-06-12T14:30:00Z

import { SiweMessage } from 'siwe'
import { BrowserProvider } from 'ethers'

async function signIn() {
  const provider = new BrowserProvider(window.ethereum)
  const signer = await provider.getSigner()
  const address = await signer.getAddress()

  // 1. 從您的後端取得隨機數
  const { nonce } = await fetch('/api/auth/nonce').then(r => r.json())

  // 2. 建立並簽署 SIWE 訊息
  const message = new SiweMessage({
    domain: window.location.host,
    address,
    statement: 'Sign in to My Dapp',
    uri: window.location.origin,
    version: '1',
    chainId: 1,
    nonce,
  })

  const signature = await signer.signMessage(message.prepareMessage())

  // 3. 傳送至後端進行驗證
  await fetch('/api/auth/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ message, signature }),
  })
}

import { SiweMessage, generateNonce } from 'siwe'

// 發行隨機數並將其儲存在 session 中，以便 /verify 稍後進行檢查
app.get('/api/auth/nonce', (req, res) => {
  req.session.nonce = generateNonce()
  res.json({ nonce: req.session.nonce })
})

app.post('/api/auth/verify', async (req, res) => {
  try {
    const { message, signature } = req.body
    const siweMessage = new SiweMessage(message)

    const { success, data } = await siweMessage.verify({
      signature,
      nonce: req.session.nonce,
    })

    if (success) {
      // data.address 是已驗證的以太坊地址
      // 為使用者建立 session 或 JWT
      req.session.address = data.address
      res.json({ ok: true, address: data.address })
    }
  } catch {
    res.status(401).json({ error: 'Invalid signature' })
  }
})

import { verifyMessage } from 'ethers'

// 使用者簽署的訊息
const message = `Sign in to My Dapp. Nonce: ${storedNonce}`

// 從簽章中還原簽署者的地址
const recoveredAddress = verifyMessage(message, signature)

// 與聲稱的地址進行比較
if (recoveredAddress.toLowerCase() === claimedAddress.toLowerCase()) {
  // 身分驗證成功
}