<p>Here is an example using Nami and blockfrost for you to review:
<a href="https://github.com/dendorferpatrick/nami-wallet-examples" rel="nofollow noreferrer">https://github.com/dendorferpatrick/nami-wallet-examples</a></p>
<p>Another smaller example:
<a href="https://www.npmjs.com/package/nami-wallet-api/v/1.1.9" rel="nofollow noreferrer">https://www.npmjs.com/package/nami-wallet-api/v/1.1.9</a></p>
<p>In general, all wallet content will be viewable once the user allows for a website to 'connect'. Sending assets will obviously require the user to enter the wallet spending password which is used to ultimately sign the transaction.
('wallet content' above isn't quite right as really it's assets and transactions from the actual blockchain for this wallet address).</p>
<p>My understanding is that wallet interaction is all on the client side. The wallet code gets injected into the page during/after loading.
So nothing sensitive needs to be sent back to your web server and you do not need to handle the spending password. You could choose to send back to your web server whatever information that you want from the wallet but this is already publicly available information for that particular wallet address.</p>
<p>So if a wallet has allowed a website to connect and that website is controlled by a bad actor they could try to initiate a sending out of assets and the wallet will automatically prompt the user for their spending password (this is built into the wallet and out of control of you or the bad actor).
If the user is not paying much attention they might just enter their password without thinking about it - hard to know what percentage of people would do this.</p>
<p>Is their a particular scenario that you have in mind?</p>

CC BY-SA 4.0
2022-05-13T01:12:21.093Z
2022-05-13T01:12:21.093Z
MC_Brisbane - JUST Pool
<p>If I want to start making a program that connects to the user's web wallet, such as nami in the google chrome browser, how do I ensure the security of the connection?</p>
<p>Using Nami and Google Chrome are just examples and can be replaced with an arbitrary wallet and browser, the real question here is what are the best practices I should stick to in order to make sure the connection is not taken advantage of easily by bad actors (black hat actors).</p>
<p>Do I install special plugins/extensions into the website?</p>

<wallet><nami-wallet><security><webapp><safety>
How Do I Deploy a Wallet Connector to the Website in a Safe Way
# How Do I Deploy a Wallet Connector to the Website in a Safe Way

(Asked by: username_0 on 2022-05-12)

If I want to start making a program that connects to the user's web wallet, such as nami in the google chrome browser, how do I ensure the security of the connection?

Using Nami and Google Chrome are just examples and can be replaced with an arbitrary wallet and browser, the real question here is what are the best practices I should stick to in order to make sure the connection is not taken advantage of easily by bad actors (black hat actors).

Do I install special plugins/extensions into the website?

**Tags:** wallet, nami-wallet, security, webapp, safety

---

## 1 answers

### Answer by username_1 on 2022-05-13. Score: 2 | Accepted answer

Here is an example using Nami and blockfrost for you to review:
<https://github.com/dendorferpatrick/nami-wallet-examples>

Another smaller example:
<https://www.npmjs.com/package/nami-wallet-api/v/1.1.9>

In general, all wallet content will be viewable once the user allows for a website to 'connect'. Sending assets will obviously require the user to enter the wallet spending password which is used to ultimately sign the transaction.
('wallet content' above isn't quite right as really it's assets and transactions from the actual blockchain for this wallet address).

My understanding is that wallet interaction is all on the client side. The wallet code gets injected into the page during/after loading.
So nothing sensitive needs to be sent back to your web server and you do not need to handle the spending password. You could choose to send back to your web server whatever information that you want from the wallet but this is already publicly available information for that particular wallet address.

So if a wallet has allowed a website to connect and that website is controlled by a bad actor they could try to initiate a sending out of assets and the wallet will automatically prompt the user for their spending password (this is built into the wallet and out of control of you or the bad actor).
If the user is not paying much attention they might just enter their password without thinking about it - hard to know what percentage of people would do this.

Is their a particular scenario that you have in mind?


---

