Hence asking the users to run
geth --rpc --rpcapi "eth,net,web3,personal" --rpccorsdomain "http://yourDomain is not safe.
My question is why is that the case? I have the impression the links I provided gloss through it but I am still a bit unclear.
From the answers I would like to expand/clarify a bit on my confusion:
A user logs into his computer and types
geth --rpc --rpcapi "eth,net,web3,personal" --rpccorsdomain "http://yourDomain.com" on the terminal.
This enables his node to listen to
http://yourDomain.com . Then he opens a browser and goes to the Dapp at
Then sure he would be able to mess around with his own node and accounts but how an external attacker could do that?