I am creating a desktop application which requires the user to connect their crypto wallet to "sign in".

Here is my current workflow:

1. Create a socket connection from desktop application to my server.
2. Open a browser tab on the client machine that to page on my website, with the socket ID as a url parameter
3. The page will prompt the user to connect their wallet
4. After the connection was successful, the frontend makes an API call to the backend with the wallet address and the socket ID.
5. The backend signs the wallet address with a private key and sends the address and the signature to the client's desktop application using sockets.

The problem with this is that anyone could create a socket connection to my server and then make the request made in step 4 with whatever wallet address they want and the socket ID of the connection they made. Successfully being able to impersonate someone else's wallet.

Any solutions to securely connect a the desktop app with the crypto wallet using a browser wallet extension?

The solution I am thinking about and would definitely work (if possible) is:

Use a publicly known string and encrypted it with the users private key and send this is a part of the request made in step 4. Then, the backend could just decrypt the data with the public address of the wallet and make sure it is equal to the original string. This way it can be verified that the public wallet address sent to the server is in fact owned by the user.

However, I do not think it is possible to be able to have the wallet extension encrypt data using the private key of the wallet. If there is a way that is compatible with the famous wallet extensions that would the perfect fix.