I know exposing personal over rpc is vulnerable. But is there any way I can make exposure of personal over rpc safe?
Let me state my requirement. I have deployed a cryptocurrency. Now I want to expose it's functions as api.
But for that I have to expose personal over rpc to carry out transactions. For eg. to perform transfer , I can write following code:

function transferCoin(to, amount,frm, passphrase){
    var tx=contract1.transfer(to, amount, {from: frm});

But if someone can connect to my node then he can misuse personal and empty my account.
As I was writing the question I realised that it's not only about personal but it's rpc that is insecure. For example let's consider a case where personal is not exposed over rpc. But, if someone can connect to my node via rpc, they can execute a function like:

function EtherTransfer(){
        web3.eth.sendTransaction({from:"addr1", to:"addr2", value: web3.toWei(100,"ether")});

and carry all my ethers.
So is there any solution to the problem. As I stated in my requirement I need to expose personal over rpc in order to provide api's of my contract functions to my other application.

  • 1
    setup a proxy to handle all requests for your local node. if you are on nodejs use github.com/nodejitsu/node-http-proxy
    – Badr Bellaj
    Dec 12, 2016 at 12:02
  • You need to build some middleware. These are very specific requirements, and web3 does not support them. You need to build your own API that does its own transaction validation and authentication, and then you can just use IPC to send transactions to your node securely Dec 12, 2016 at 14:16
  • You mean I have to code forsomething like web3??? I can use web3 to perform every task that I require, but I want to know how can I make it more secure? Dec 13, 2016 at 4:49
  • Also..the question raises a second scenerio that RPC is unsafe(with or without Personal). What about that. Shall I raise another question for second case Dec 13, 2016 at 4:52

1 Answer 1


Before you sendTransaction, you need to execute unlockAccount with your passphrase, so the vulnerable is mainly caused by your weak passphrase, not too much with the exposed interface.

  • Presumably if Prashant's account needs to have Ether in it he sometimes needs to unlock that account to do whatever it is that needs access to them, so a strong password won't be enough. Dec 15, 2016 at 3:38
  • You can use the signAndSendTransaction (renamed recently) that will not generally unlock your account - see ethereum.stackexchange.com/questions/7196/… . Dec 15, 2016 at 4:34
  • 1
    @BookyPoohBah How can I use personal.sendTransaction when I have to send Transaction via RPC. There is no function like web3.personal.sendTransaction(). This function works only from geth console. Dec 15, 2016 at 9:02
  • @PrashantPrabhakarSingh You are right that it is not included in the current version of geth. It is documented for JSON-RPC in github.com/ethereum/go-ethereum/wiki/…, but is still an outstanding issue #2 to be implemented in geth. Dec 15, 2016 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.