search

anon-real / ErgoAuctionHouse

Decentralized auction on top of ERGO.
https://ergoauctions.org
MIT License
30 stars 18 forks source link

Serve over HTTPS #2

Closed jasondavies closed 3 years ago

jasondavies commented 4 years ago

I think it's dangerous to serve an app over HTTP that requires the user to provide their API key giving full unrestricted access to their local node and wallet.

Even if the app author is trustworthy, it is quite trivial for a network attacker to perform a MITM attack and inject malicious code. Even if the risk of this happening right now is fairly low, it sets a bad precedent for future apps.

AFAIK, modern browsers treat 127.0.0.1 as a trustworthy context and it should be possible to access from a secure context. (Note: not "localhost", since this could in theory be made to resolve to other IP addresses).

anon-real commented 4 years ago

Assuming that the author is trustworthy (the app is open-sourced and has been audited at some level): If the user's node is not local then I strongly suggest running the app locally via docker or npm (will add a note on the website about it too). Switching to HTTPS is very trivial but will be a hassle for users who run their nodes in their secure network (VPN maybe) since browsers don't allow mixed contents.

anon-real commented 4 years ago

@jasondavies However will switch over HTTPS as soon as https://github.com/ergoplatform/ergo/issues/1217 is done.

anon-real commented 4 years ago

Explained here a bit: https://www.ergoforum.org/t/some-details-about-ergo-auction-house/428 Will keep the issue open to see what happens on the node's side https://github.com/ergoplatform/ergo/issues/1217.

anon-real commented 3 years ago

Done!