In this answer, it is suggested that it is not safe to use --wsorigins="*" for security reasons. What are the security reasons?

=> How could I make WS-RPC server connection secure in geth?

If I use following flags, would it be enough for security: --ws --wsaddr="" --wsorigins "*"; where I have replace -wsaddr="" with -wsaddr="" in order to connect only from localhost.

--wsaddr value WS-RPC server listening interface

--ws Enable the WS-RPC server

--wsorigins value Origins from which to accept websockets requests

2 Answers 2


As a general rule of thumb, any open port is a security risk. The best way to prevent an attack by malicious actor would be to have no doors and no windows.

Specifically, in blockchain nodes, the risk is stealing funds from the account the node operates, or just overloading your node with requests.

So by default, the node listens only to localhost loopback interface, so you'll be able to connect locally using either localhost or IP from the server itself.

If you wish to connect from another device on the same LAN, you can bind the node to its LAN IP address, such as, it will then listen only on this local IP and shouldn't be listening to your public internet IP.

By using --wsorigins="*" you connections from any interface to be accepted, even ones coming from the internet, which unless you have a router blocking these - is risky.

If you have a well configured firewall and filter ports properly, your machine should be safe from external internet access and can safely use --wsorigins="*", but again - that's only if you know what you're doing.


You can try to whitelist your dApp IP/domain


geth --http --http.corsdomain <YOUR IP or DOMAIN>

All information you can find here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.