ipfs / ipfs-webui

A frontend for an IPFS Kubo and IPFS Desktop
https://webui.ipfs.io
MIT License
1.55k stars 483 forks source link

Explore page: stop sending requests to remote HTTP servers #2266

Open lidel opened 2 days ago

lidel commented 2 days ago

this is remaining part of regression initially identified in https://github.com/ipfs/ipfs-webui/issues/2250

Bug

Explore page triggers block and delegated routing request to remote HTTP servers, including ones outside of control of IPFS project.

2024-09-17_14-32

This is bad because it does not leverage local gateway, wastes bandwidth, and leaks IPs and CIDs to third party servers, which is extra bad in private cluster contexts.

Expected behavior

Only the local Kubo RPC and Gateway should be used when IPLD Explorer is used in ipfs-webui.

lidel commented 2 days ago

@SgtPooki found this after testing latest main branch with https://github.com/ipfs/ipfs-webui/issues/2250 merged, preferably we would fix this and then tag a release to close the privacy leak for private swarm users.

(fine to pick it up after you are back from JS week, we just want to include it in Kubo 0.31 https://github.com/ipfs/kubo/issues/10499)

SgtPooki commented 1 day ago

@lidel explorer components should only be calling remote gateways if it's enabled: https://github.com/ipfs/ipld-explorer-components/blob/cad6b454ec83940dea86ee1bfb20c415ce9efd18/src/lib/init-helia.ts#L20-L40

I think we can just add a localStorage.setItem('explore.ipld.gatewayEnabled', false) in ipfs-webui to disable this behavior for webui

lidel commented 14 hours ago

@SgtPooki tried that, but then nothing works, just infinite spinner (for blocks that were not cached).

feels like there needs to be another setting which only uses specific gateway (webui would pass localhost one) and does not use delegated routing?