signing-security with web3

client.ts

const web3 = new Web3(context.library.provider);

const thingToSave = {
  message: 'Hello world',
  owner: address,
};

const hashedData = web3.eth.accounts.hashMessage(
  JSON.stringify(thingToSave)
);

try {
  const signature = await web3.eth.personal.sign(
    hashedData,
    address,
    null
  );

  const result = await postData(`/api/something`, {
    data: thingToSave,
    signature,
  });

} catch (e) {
  console.log('Error madafacka', e)
}

server.ts

function isValidMessage(thingToSave) : boolean {
  const web3 = new Web3(
    new Web3.providers.HttpProvider(process.env.RPC_PROVIDER)
  );

  const hashedData = web3.eth.accounts.hashMessage(JSON.stringify(thingToSave));

  const signingAddress = web3.eth.accounts.recover(hashedData, signature);

  if (signingAddress !== thingToSave.owner) {
    // DATA IS INVALID, the signer does not equal the address in the message
    return false;
  }

  return true
}

Hashing the data is optional

coolio