0

I have the code below. In testing this actually works but there is no security from what I have seen. The node is at an IP address and the node code just states the default account is coinbase.

So how should this security flaw be addressed? If when the account issue is solved then still anyone can access the network - it is a private network. I know ufw can be used to restict IPs but I understand it is not difficult to fake an IP address.

web3=require('web3');
var myweb3 = new web3(new web3.providers.HttpProvider('http://10.154.0.2:8505'))
;
  var contractaddress= "0x16a09128f41bffc590421f6d409930368267a3f4";
  var abi=
    [{"constant":true,"inputs":[],"name":"inventoryWeight","outputs":[{"name":""
,"type":"uint256"}],"payable":false,"stateMutability":"view","type":"function"},
{"constant":false,"inputs":[{"name":"hashInventory","type":"bytes32"}],"name":"a
ddInventoryHash","outputs":[],"payable":false,"stateMutability":"nonpayable","ty
pe":"function"},{"constant":false,"inputs":[{"name":"inventory","type":"string"}
,{"name":"hashInventory","type":"bytes32"}],"name":"addInventory","outputs":[],"
payable":false,"stateMutability":"nonpayable","type":"function"},{"constant":tru
e,"inputs":[{"name":"","type":"bytes32"}],"name":"inventories","outputs":[{"name
":"","type":"string"}],"payable":false,"stateMutability":"view","type":"function
"},{"constant":true,"inputs":[{"name":"","type":"uint256"}],"name":"inventoryHas
hesStorage","outputs":[{"name":"","type":"bytes32"}],"payable":false,"stateMutab
ility":"view","type":"function"},{"constant":false,"inputs":[{"name":"weight","t
ype":"uint256"}],"name":"addWeight","outputs":[],"payable":false,"stateMutabilit
y":"nonpayable","type":"function"},{"constant":true,"inputs":[],"name":"getAllIn
ventories","outputs":[{"name":"","type":"bytes32[]"}],"payable":false,"stateMuta
bility":"view","type":"function"},{"constant":true,"inputs":[{"name":"","type":"
uint256"}],"name":"inventoryHashes","outputs":[{"name":"","type":"bytes32"}],"pa
yable":false,"stateMutability":"view","type":"function"},{"payable":true,"stateM
utability":"payable","type":"fallback"},{"anonymous":false,"inputs":[{"indexed":
false,"name":"hashInventory","type":"bytes32"}],"name":"eventNewInventory","type
":"event"},{"anonymous":false,"inputs":[{"indexed":false,"name":"hashInventory",
"type":"bytes32"}],"name":"eventNewStorageInventory","type":"event"}]
myweb3.eth.defaultAccount = myweb3.eth.coinbase;
let commodityContract = myweb3.eth.contract(abi).at(contractaddress);
    commodityContract.addWeight(77888555);
  • Some it uses http protocol to comunicate between a node and a client you can use existing tool to secure communication, like ssl, a proxy like http, a firewall, etc. – Ismael Apr 21 '18 at 22:29
  • I think the solution is to use CORS under RPC. I am testing this. – Trevor Oakley Apr 23 '18 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.