Implement Secure Web3 Authentication

This is a Web3 authentication skill for wallet-based, signature-based login that replaces passwords with cryptographic proof of wallet ownership, covering three message-signing standards - EIP-191 (Ethereum Signed Message), EIP-712 (typed structured data), and SIWE (Sign-In with Ethereum, an RFC-compliant standard). It implements SIWE end-to-end: fetching a server-issued nonce, constructing a SiweMessage with the domain, address, statement, and nonce, signing it client-side, and posting it back for server verification:

import { SiweMessage } from 'siwe';

const createSiweMessage = (address, statement, nonce) => {
  const message = new SiweMessage({
    domain: window.location.host,
    address,
    statement,
    uri: window.location.origin,
    version: '1',
    chainId: 1,
    nonce,
    issuedAt: new Date().toISOString()
  });
  
  return message.prepareMessage();
};

const authenticateWithSiwe = async (signer) => {
  // Get nonce from server
  const nonceResponse = await fetch('/api/nonce');
  const { nonce } = await nonceResponse.json();
  
  const address = await signer.getAddress();
  const message = createSiweMessage(address, 'Sign in to MyApp', nonce);
  const signature = await signer.signMessage(message);
  
  // Verify with server
  const authResponse = await fetch('/api/verify', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ message, signature })
  });
  
  return authResponse.json();
};

The matching server side validates the SIWE message and its signature, checks the nonce against a single-use store to block replay attacks, and issues a JWT scoped to the recovered wallet address and chain ID.

Use this skill when building wallet-based login for a dApp or Web3-integrated app - it covers MetaMask connection via window.ethereum, multi-wallet support through @web3-react connectors (injected wallets and WalletConnect), EIP-191 message signing and server-side signature recovery via ethers.utils.verifyMessage, and EIP-712 typed-data signing for structured authentication payloads. It also handles multi-chain configuration (named RPC endpoints for Ethereum, BSC, Polygon, and Avalanche with chain-ID allowlisting) and wallet-specific error codes (4001 for user rejection, -32002 for a pending connection request, 4902 for an unsupported network needing wallet_addEthereumChain). Its security fundamentals are explicit: never request private keys or seed phrases, always use single-use nonces with an expiry to prevent replay attacks, and validate wallet ownership strictly through signature verification. It is not a general OAuth/SSO skill - it's scoped specifically to blockchain wallet-signature authentication, so it isn't the right fit for conventional username/password or third-party-identity-provider login.

Input is a connected wallet's address and a signed message, via MetaMask, WalletConnect, or another injected provider; output is a verified identity - a recovered address matched against the claimed one, a validated and consumed nonce, and a JWT (24-hour expiry in the example) carrying the wallet address and chain ID, checked on subsequent requests by an auth middleware that verifies the token before attaching req.user.

Built on ethers.js for signing and signature verification, @web3-react connectors for MetaMask and WalletConnect, the siwe library for Sign-In with Ethereum, jsonwebtoken for session tokens, and Redis for nonce storage with expiration.

Web3 developers adding wallet-based authentication to a dApp who need signature verification, SIWE, multi-wallet and multi-chain support, and replay-attack-resistant nonce handling implemented consistently, rather than building each piece from scratch per project.