When using geth as client and web3(javascript api) to interact with it through a web browser, other nodes in the network can access the client given the IP and the port on which the client is running.

How can this be prevented?

How can the access be restricted to the node(computer) running the client and not the others in the same network?

the flow is as follows

Browser(user)----->Server(running the node)------>GETH

the first link is http and the second link is rpc. the http link makes it possible for other computers to access my node which is to be stopped.

Only the node(computer) running the geth client should access the geth client.

  • Not sure, but I think --rpccorsdomain may help. Jul 19, 2017 at 5:18
  • I am a bit confused here. My connection is such User(browser)----(http)--->Computer Server(node running the client geth)----(rpc)----->geth now other computers in the network can access my geth client through the app hosted by my computer...I want to restrict that
    – anonymous
    Jul 19, 2017 at 6:17

4 Answers 4


This can be prevented by introducing a middleware, which will talk to your geth node and let your UI talk to the middleware instead of talking to geth node directly.

I faced a similar issue and I solved it by creating a middleware in Node.js

With this, your geth node won't be exposed to the public and that saves us from some security issues.

enter image description here You can check this project for reference - https://github.com/Imaginea/lms

  • I am new to this. Can you tell me about some references that can help me understand exactly how this is to be done
    – anonymous
    Jul 21, 2017 at 10:19
  • 1
    Edited my answer for your better understanding of my proposed architecture. Also, for reference you can look into the Github URL I've shared, this is built on the same architecture I've shared. let me know if you find difficulty understanding it.
    – Sanchit
    Jul 21, 2017 at 11:56
  • Is the middleware similar to an http server?. I have an http server running on node.js. My problem is all people having access to the server hosted app can communicate with the geth client. Also thanks a lot for your help.
    – anonymous
    Jul 21, 2017 at 13:38
  • 1
    yes, it is similar to an HTTP server and if your geth node is running on port 8545 which is not accessible outside of the box(machine), that means your UI/or any one else can't interact with geth node by any chance apart from node.js server(which is on the same machine)
    – Sanchit
    Jul 21, 2017 at 13:56
  • 1
    Implement authentication, only authenticated users shall be able to execute commands.
    – Sanchit
    Jul 23, 2017 at 14:44

I think rpccorsdomain may be the thing you are looking for.

--rpccorsdomain: value Comma separated list of domains from which to accept cross origin requests (browser enforced)

You can specify rpc doamins like:

geth --rpccorsdomain 'http://localhost:8080', 'http://xxx:8080'
  • This is a worthwhile security measure, but can easily be faked. Jul 19, 2017 at 15:49

Some misc thoughts.

Things can be faked. A committed attacker can interact with a public node. Simple as - that is the nature of a public node.

That said you can do things to make it harder. The RPC configuration options - --rpccorsdomain for example, and --rpcport to restrict how your node can be accessed.

Another option is to 'hide' your node behind a proxy.

You could for example use nginx with a proxy configuration location.

location /node {

      proxy_pass http://node-ip:node-port;

That way only the proxy address is exposed to the end user.

For securing Ether, do not 'save' accounts on a publicly accessible node. If you do, do not unlock them for longer than necessary. Ideally use a hardware wallet to store value.

If there is nothing to target or steal no-one will attack you..


I suggest you to use Caddy as a reverse proxy with HTTP Basic Authentication. Caddy comes with built-in TLS (HTTPS) certificate manager which makes the setup easier.

Here is an example Caddyfile configuration

# Protect with password to prevent the server ending up in the Google index.
# The password is angrybird, generated with cadddy hash-password.
# This is mostly protecting against 
# https://caddyserver.com/docs/caddyfile/directives/basicauth
vitalik.tradingstrategy.ai {

    basicauth / {

       rpcuser JDJhJDE0JGEuVEZqOWp1QU9Jd0l5OTRFOW0wWU9wSlVBekd4UmNEM0w3eGFWekxBUEkvR1JRZkpZWmdh



Here are instructions how to generate Caddy password hash.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.