How to use the BDKp for login authentication with out making contact to a database(A Free Tutorial - Usually a Donors Privilege)Foreword:Obviously the point of an authentication system is to "save" some data attached to that "account" that the user owns so although you'd probubly want a database to save user interaction information for your web site (or service) you can authenticate the visitor with their Bitcoin address (With out making contact with the database initially) and this is makes logins more powerful because for
one you need the Private Key to the Bitcoin address to even attempt to login which requires an attacker to gain access of your visitors computer/cellphone(Which are usually turned on/off constantly).
two there is no passwords stored on servers so this way if there is a database compromised users can feel safe to know that they don't have to change "ALL" their passwords for other websites that use the same pass that was compromised.
three this could add security to database compromise for sensitive information and provide control to the users, authenticated users can have their sensitive data encrypted to only open up with their private key this could force some business models to require user authorization before any data can be processed(This makes users feel safe online). Also if a business wanted the security of the encryption from database compromise but wanted to process data while the user is offline they can send their user data to a processing server that is separate from their website servers which would promote security for everyone. \
Okay so here is the example codes
Step 1First off you need to ask the user what their Bitcoin address is. Once you have received that information you can then continue to "Step 1" of authenticating a user.
The first step requires you to enter the Bitcoin address into the function and it will spit out a string for the user to "Sign" with the in-putted Bitcoin address
$coin_auth_step1 = bdk_login_with_coin_address('1NaEAzo1SSzinaSodBicxA6ugd3edDzX7d', 1);
if($coin_auth_step1["return_status"] == 1){
//Successfull function execution happened, we can safely be rest assured that we can echo to the user a string to sign
echo "Sign the following string but copying and pasting it into the "Sign Message" dialog found in your Bitcoin client.
";
echo $coin_auth_step1["string_to_sign"];
}else{
//Something happened tell the user to try again
echo "Try again";
}
Step 2The user should be given a single line input text box to input the signature. once the user has pasted in their signature and presses submit, the form submission should tell the next page what the original data was (The BDK library will check the checksum if the data has been broken/altered)
So in the submission page it should look like this (With form variable-values already in-putted)
$coin_auth_step2 =bdk_login_with_coin_address('1NaEAzo1SSzinaSodBicxA6ugd3edDzX7d', 2, 'H1toEU8fhdT5SrMWTKpsRi/2/S93o+zRfUAyfmVS7ew6PoOepO0VOCX5+XZJSo81LX7+I8VixTWjhAskqnCYeVM=', 'MTM1NDk5ODQxMHwyYzYzNTVmZWQxYzdmM2NjOGQyNTFiZDc4N2VlNWIzZDZkZGE2YmE1NjdmOTg3MDU0MWI0ODQ2OGIyN2QxYWIxfDU1NjUwMDM5MDgwYzdmY2Y2ZjJmNjlmZWJlMjM4YmIwODY4MTVkMGIxNmUyMmQyYjllZGI0OGZiOWFiZDIxOWYwZWFkNWQ0ZWMxYzBkZmRlODU5ZTk2ZmM5NGZmZDQ4NzkzOTJlYWMzNTI5ZGQwMzU1ZTQzNjI5YTA0MTBhNWY3YTljYmE0Y2QwY2Y3YTBhZjlkNjI4MzNiODk5YWM1NGNkZTZkMmI5ZmZiNWYxZTJiM2NiYzYxYzgxMmYyYTU5YWE5OTg5MTE3MWYyNTEzYmY0YWZjMzcyYzE2YTVkNzU5NjYxZDRkNGMyYTg5ZGI4NzcyNWQwZjU5ODVmMTQyMmZ8MU5hRUF6bzFTU3ppbmFTb2RCaWN4QTZ1Z2QzZWREelg3ZA');
if($coin_auth_step2["return_status"] == 1 && $coin_auth_step2["bitcoin_address_authenticated"] == 1){
//Successfull authentication!
echo "YOU OWN THAT ADDRESS :) Welcome back!";
//This is were you execute your session functions.
}else{
echo "FAILURE";
}
?>
NOTES: The user has 20 minutes to sign the request and submit to server before it is invalid