0

I have a dapp node which uses web3js to send transactions to quorum geth node. The html pages shows the http provider and the ports. In theory anyone can use these ip and public address in the html to do postman rpc json calls to transfer assets away.

How can someone secure these ports when they are required to be opened for web3js to send transactions to? By openiny these ports anyone can connect to.

Of course one can firewall to allow only the dapp instance to connect to. But the dapp static html page will still hold thr connection details. One can also use an active directory or nginx to secure the access to the dapp and/or json rpc api.

Are there any other solutions on top of the above mentioned to secure quorum geth nodes?

Improve this question

2 Answers 2

Reset to default
1

basically, the only security for rpc right now is exactly what you said: secure and lock down the access to the box.

Next version of Quorum will include secure rpc end-points, tho I do not have implementation timeline for you just yet. Additionally, cakeshop offers secured API that maps rpc into rest / socket based APIs.

Improve this answer
2
0

Quorum nodes now offer Json-rpc call in https. it works with OAtuth2. Please check this documentation page for the same. There is still nothing mentioned about secure the node.

https://docs.goquorum.consensys.net/en/latest/HowTo/Use/JSON-RPC-API-Security/

Improve this answer
1
  • i asked this 3 years ago
    – Nathan Aw
    Commented Oct 6, 2021 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.