3

When using web3 js to connect to ethereum private network, I just configured the http provider of the web3 instance to connect to the node.

how is just info about RPC endpoint sufficient to be able to connect to a node.

shouldn't there be some user authentication in place? because with just a RPC endpoint we were able to do what ever we want with the blockchain?

Is it just like that ? or am I missing some thing here?

3

By default, the RPC interface does not expose the personal API, and so you cannot unlock accounts over it, so people cannot just send transactions from your accounts. In general, though, it is best practice to store keys locally, on the client side (in the browser, for instance), and then send pre-signed transactions over the RPC interface.

That's not to say that authentication is a bad idea- publicly exposed RPC interfaces can be an easy DOS vector, and if you do unlock accounts, you don't want people sending from them. That's why best practice is to have the client listen only to localhost, and use the CORS protection so that requests can only come from a single domain. You can set this by starting geth with the

--rpccorsdomain "myDomain.com" flag.

| improve this answer | |
  • that means cant we create a contact through webjs? does the evm blocks the account unlocking when connected with RPC? because not having code is not a problem as there is already available in the node. – mahesh gupta Dec 12 '16 at 7:44
  • There's a layer of abstraction here that I think you're missing. The EVM doesn't care how a transaction gets signed. But someone needs to sign the transaction and pay for gas. By default, your geth node won't allow unlocking accounts via RPC, but you can always unlock over IPC, enable unlocking via RPC – Tjaden Hess Dec 12 '16 at 14:06
  • 1
    So if it possible to create an app in truffle that allows users to make transactions using a web interface? I'm still not clear how one would achieve that. :/ – Omkar Khair Mar 12 '17 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.