NFID authorization security ensuring

Developers JavaScript
1

Hi all! I’m integrating NFID into my project and trying to figure out how I can ensure authorization security.

For the frontend, I use @nfid/embed library.
Project backend is on PHP.

Currently, I only transfer to my backend the public key and store it there, and then issue an internal session token, but now the public key can be sending from anywehere, including Postman, and anyone can do this as I don’t check if the public key id valid or not.

I’m trying to figure out how I can validate that authorization on the frontend actually happened successfully on the NFID side, and the public key is valid?

There is an idea to encrypt the public key using the signature from the response and OpenSSL, but this is a fallback option, and if possible I’d like to use a native security method.

Thanks for your answers!

2

I think @dostro and his team can help with this one!

3

@nfid/embed is frontend library, so it seems you are looking for smth like https://internetcomputer.org/docs/current/developer-docs/web-apps/independently-verifying-ic-signatures, unfortunately there is no php cdk, but u can theoretically use @dfinity/standalone-sig-verifier-web npm package and run js in php

1 Like