As far as I understand Ethereum uses JSON-RPC to communicate between clients. What is the authentication mechanism? That is, how does the network know that the RPC request is coming from a legit client?


The JSON-RPC interface will talk to anyone who is able to communicate with it over the network. The alternative, IPC, uses a UNIX socket, and will talk to anyone who can access that socket.

If you want to restrict access, you can put it behind a web server that handles authentication and forwards the requests if they are authenticated. See here for an example of how to do this: https://tokenmarket.net/blog/protecting-ethereum-json-rpc-api-with-password/

  • Thanks for your answer but if any geth developers are reading this: Why not allow geth users to set a password for RPC communication?? Jan 23 '20 at 11:17
  • I don't speak for the Geth developers but JSON-RPC is already only happening over plaintext, so if you're doing anything other than talking to your own node on localhost that requires credentials you'll also need HTTPS around the connection. So you'd end up building a lot of features in Geth that duplicate things that are already done by a very robust, long-tested web server. Better to keep Geth simple, and use a web server for things a web server is good at. Jan 24 '20 at 23:26
  • Yes, you can put a thin web server in front of geth, like nginx or flask, and then let this server pass the requests on to geth on localhost. Jan 25 '20 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.