msg.sender 'spoofing' when function is public or external

Question

I have a Smart contract where I want only the onwer to call a specific function, for example:

function getInfo() view public onlyOwner() returns (address) {
  return msg.sender;
}
.....
modifier onlyOwner ()  {
  require ( msg.sender== my_owner);
}

I can build a web3 call slaiming to be (calling from) any address, in this case the owner of the contract, for example:

web3 = new Web3(App.web3Provider);

......
if(directAccessMode)
    web3.eth.defaultAccount =   '0x1111111111111111111111111111111111111111';
......

and be able to geth the required information without any check from EVM that I am really the 'owner' of the address I am claiming to be even avoiding using the address' access details.

I am aware that smart contract data is public nevertheless I do not understnad why there is no control on caller's address validity.

Thanks

Answer 1

When your function is executing on-chain, the caller cannot set msg.sender to whatever they want. msg.sender will always be the user account or the contract that is calling your contract function. It can never be something like 0x11111111...

When your function is executing off-chain (e.g. a view function being called from web3), the caller can set msg.sender to whatever they want. This is not a security risk, because:

1. A function that executes off-chain cannot change the contract state, perform on-chain transactions or do anything else on-chain. It can never have any effect on anyone else's function calls.

2. All data stored on-chain is publicly readable. Even if there isn't a view function to read it, you can still read any contract state variable using web3.eth.getStorageAt(...).

Answer 2

I believe there is protection from someone attempting to spoof your owner address. This is because although msg.sender may be modified for the tx, it will not succeed b/c the tx must be signed with the private key of the actual account, which the spoofer does not possess.