How can one secure Web3 JSON-RPC API endpoint?

Question

When using geth as client and web3(javascript api) to interact with it through a web browser, other nodes in the network can access the client given the IP and the port on which the client is running.

How can this be prevented?

How can the access be restricted to the node(computer) running the client and not the others in the same network?

the flow is as follows

Browser(user)----->Server(running the node)------>GETH

the first link is http and the second link is rpc. the http link makes it possible for other computers to access my node which is to be stopped.

Only the node(computer) running the geth client should access the geth client.

Answer 1

This can be prevented by introducing a middleware, which will talk to your geth node and let your UI talk to the middleware instead of talking to geth node directly.

I faced a similar issue and I solved it by creating a middleware in Node.js

With this, your geth node won't be exposed to the public and that saves us from some security issues.

You can check this project for reference - https://github.com/Imaginea/lms

Answer 2

I think rpccorsdomain may be the thing you are looking for.

--rpccorsdomain: value Comma separated list of domains from which to accept cross origin requests (browser enforced)

You can specify rpc doamins like:

geth --rpccorsdomain 'http://localhost:8080', 'http://xxx:8080'

Answer 3

Some misc thoughts.

Things can be faked. A committed attacker can interact with a public node. Simple as - that is the nature of a public node.

That said you can do things to make it harder. The RPC configuration options - --rpccorsdomain for example, and --rpcport to restrict how your node can be accessed.

Another option is to 'hide' your node behind a proxy.

You could for example use nginx with a proxy configuration location.

location /node {

      proxy_pass http://node-ip:node-port;
}

That way only the proxy address is exposed to the end user.

For securing Ether, do not 'save' accounts on a publicly accessible node. If you do, do not unlock them for longer than necessary. Ideally use a hardware wallet to store value.

If there is nothing to target or steal no-one will attack you..

Answer 4

I suggest you to use Caddy as a reverse proxy with HTTP Basic Authentication. Caddy comes with built-in TLS (HTTPS) certificate manager which makes the setup easier.

Here is an example Caddyfile configuration

# Protect with password to prevent the server ending up in the Google index.
# The password is angrybird, generated with cadddy hash-password.
# This is mostly protecting against 
# https://caddyserver.com/docs/caddyfile/directives/basicauth
vitalik.tradingstrategy.ai {

    basicauth / {

       rpcuser JDJhJDE0JGEuVEZqOWp1QU9Jd0l5OTRFOW0wWU9wSlVBekd4UmNEM0w3eGFWekxBUEkvR1JRZkpZWmdh
    }

    reverse_proxy 127.0.0.1:8545

}

Here are instructions how to generate Caddy password hash.