0

I was wondering whether this was a safe way to render certain elements only for specific pubkeys when connected through Solana wallet adapter in Nextjs. This code returns an < AdminPanel /> when we are logged in with one of the pubkeys in adminList[].

import { useWallet } from '@solana/wallet-adapter-react';
    
const { publicKey } = useWallet();       
if (publicKey.toBase58() === adminList[1].publickey)
        ) {
            return ( <AdminPanel /> ); }
else {
return ( <UserPanel /> ) ; }

I realize I have to protect my api routes as well when fetching data, but would it be possible for someone with bad intentions to access the AdminPanel element without being logged in with one of the pubkeys in the adminList[] array?

Thanks in advance!

Improve this question

1 Answer 1

Reset to default
1

I think the Backend API Protection should be there for sure and better bring in the AdminList from the backend and then validate. I would suggest to make the publickey validation more secure better sign a message before doing this check so that the platform get's 100% sure that its a legit address.

Improve this answer
4
  • Thank you! The adminList does come from the backend. I will look into backend API protection & message signing! If you have any suggestions for auth libraries to go with sol wallet adapter, please let me know. I'm using TRPC & Vercel as back-end. Thanks again!
    – Matti
    Commented Sep 22, 2022 at 15:07
  • awesome i have heard good things about TRPC will try it out soon, what type of auth are you looking for is it like phantom,solflare and all the wallets in solana or do you mean something else by auth
    – Pratik.js
    Commented Sep 22, 2022 at 15:41
  • I'm wondering whether I can be sure that that specific user is logged in on Solana with that Phantom/other Sol wallets if I run ` if (connected && publicKey === pubkeyfromdb ) ` after ` const { publicKey, connected } = useWallet(); ` Or do I need to sign a message everytime I grant someone access to my database based on {publicKey && connected} ? I think I will run nextauth in parallel as backend API Protection, signing in & out as connected becomes true or false. I'm new to Solana so open to suggestions! 🙏
    – Matti
    Commented Sep 22, 2022 at 18:34
  • Sounds Good but just makes sure to remove the DB access on refresh or on wallet change/reconnect
    – Pratik.js
    Commented Sep 23, 2022 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.