how to configure block explorer securely?

Question

There are many block explorers that offer this service publicly, they are based on this explorer:

github.com/etherparty/explorer

I tried to use it, but to make it work (so my users could explore blocks of our private net) I have to open RPC port for everyone using --rpccorsdomain "*", and bind RPC port to an external network interface. AFAIK this is very insecure, and exposing such a complex API may lead to a remote exploit somehow, probably. Setting up proxies from nginx and stuff like that also won't work, because the request to RPC is made from the browser of the client, and the client is located somewhere on the internet.

So my question is , how do this people configure their block explorer in a secure manner? I would also like to offer a public block explorer for my net but I don't want to be hacked.

Answer 1

From this answer the insecure approach:

How could "ethereum block explorer" connect into geth that is already running on the main server securely?

Bit more secure approach:

You can play with the --rpccorsdomain to add your custom domain and accept only request from this domain, this is a bit more secure but not the most secure.

Also you can authorize the usage of some API of geth like --rpcapi "web3" to take more control about it.

A good practice that are using today a lot of big explorers is developing an API with a geth server in the backend with custom authentication like apikeys for example.

Don't forget that the Blockchain is an other powerful tool for developments but if you need to use another layer for the management/queries with more security you need to develop in a custom way.

Another idea is develop a distributed API across geth clients using already code in swarm mode, but I think is a hard task to do.