I'd like to build a web wallet that let's people make transactions. I'm best at python so right now I ask for the secret key in a form with the other transaction information, send it to my server, build the transaction, sign it, and send it to the Stellar network.
I am not a security expert, but I am fairly confident that sending the secret key to my server is a potential attack area.
Is there a good way to deal with this? My two thoughts are:
Build the entire transaction on the server but somehow send it to the client to be signed and sent to the stellar network.
Build a downloadable exe file that has all of the code to build the transaction that the user can download, sign and hit run.
Both of these options would require a significant amount of work I'd rather avoid, but I'll do what's necessary to protect my future users. Any advice is appreciated. Thanks!