I just spun up a geth node on my home server with flags --http.addr= --http.vhosts=* --http.corsdomain=* --ws --ws.origins=* --ws.addr= I am using a nginx reverse proxy to make it accessible at eth.mydomain.com. I did not create any accounts or private keys within geth, so getting my funds stolen is not applicable.

Are there any security risks of having my RPC be publicly exposed? I would imagine DoS/DDoS attacks would be the only vulnerability but are there others I haven't thought of?

If so, what would be a safe authentication method? I don't think basic HTTP auth would work within metamask or web3js, or am I mistaken about this?

1 Answer 1


In your terminal:

sudo apt install apache2-utils -y
sudo htpasswd -c /etc/nginx/.gethauth username

then in your nginx conf:

server {
    listen 80 default_server;
    location / {
        auth_basic "Protected Area!";
        auth_basic_user_file /etc/nginx/.gethauth;
        proxy_set_header Host $host;

in web3js you put "http://USERNAME:PASSWORD@IPADDRESS"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.