I see how to setup an ethereum node with NGINX as a proxy and basic http access control in order to protect my node to be used and abused by third parties.
https://medium.com/coinmonks/securing-your-ethereum-nodes-from-hackers-8b7d5bac8986
I'm trying to figure out how to replace the http access control and instead check token ownership from a ERC721 smart contract using the balanceOf method any ideas on how to implement a middleware, can I use express to output the response ?
You can use client-side certificate to secure your node's incoming connections.
To do so, implement your own variation of HttpProvider (example), just allow to send client side certificate. You can also pin your node's self-signed certificate.
Now define a CA for your backend, create and self-sign a certificate for the node, also create and sign a cert for the client.
In nginx.conf define the node cert and require client to be signed by your CA -
server {
listen 443 ssl http2;
server_name your.local.host;
ssl_certificate server.crt;
ssl_certificate_key server.key;
ssl_client_certificate ca.crt;
ssl_verify_client on;
proxy_set_header X-SSL-CERT $ssl_client_cert;
proxy_set_header x-ssl-verify $ssl_client_verify;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location / {
proxy_pass http://localhost:8545;
}
}
Your node will now be available through https://your.local.host and require a client-side cert signed by CA. That's about the safest as can be.
I'm trying to figure out how to replace the http access control and instead check token ownership from a ERC721 smart contract using the balanceOf method any ideas on how to implement a middleware, can I use express to output the response ?
Such check is not possible in Nginx, or any web server middleware, or is prohibitively complex. However you could do this at the application layer with using Sign in with Ethereum.
