0

I see how to setup an ethereum node with NGINX as a proxy and basic http access control in order to protect my node to be used and abused by third parties.

https://medium.com/coinmonks/securing-your-ethereum-nodes-from-hackers-8b7d5bac8986

I'm trying to figure out how to replace the http access control and instead check token ownership from a ERC721 smart contract using the balanceOf method any ideas on how to implement a middleware, can I use express to output the response ?

How can an app using the web3 rpc api be secured?

2 Answers 2

0

You can use client-side certificate to secure your node's incoming connections.

To do so, implement your own variation of HttpProvider (example), just allow to send client side certificate. You can also pin your node's self-signed certificate.

Now define a CA for your backend, create and self-sign a certificate for the node, also create and sign a cert for the client.

In nginx.conf define the node cert and require client to be signed by your CA -

    server {
        listen          443 ssl http2;
        server_name     your.local.host;

        ssl_certificate      server.crt;
        ssl_certificate_key  server.key;

        ssl_client_certificate ca.crt;
        ssl_verify_client on;
        proxy_set_header    X-SSL-CERT              $ssl_client_cert;
        proxy_set_header    x-ssl-verify            $ssl_client_verify;

        proxy_set_header        X-Real-IP               $remote_addr;
        proxy_set_header        X-Forwarded-For         $proxy_add_x_forwarded_for;

        location / {
            proxy_pass          http://localhost:8545;
        }
    }

Your node will now be available through https://your.local.host and require a client-side cert signed by CA. That's about the safest as can be.

1
  • The variation of the HttpProvider needs to be on the server side how can I implement this ? I'm use to using express with nodejs how to send an error or let the request pass if the person is authorized with json-rpc and my nodejs api ? May 6, 2022 at 19:25
0

I'm trying to figure out how to replace the http access control and instead check token ownership from a ERC721 smart contract using the balanceOf method any ideas on how to implement a middleware, can I use express to output the response ?

Such check is not possible in Nginx, or any web server middleware, or is prohibitively complex. However you could do this at the application layer with using Sign in with Ethereum.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.