Skip to content
This repository was archived by the owner on Nov 15, 2023. It is now read-only.

jsonrpsee: add host and origin filtering #9787

Merged
niklasad1 merged 6 commits into from
Sep 15, 2021
Merged

jsonrpsee: add host and origin filtering #9787

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
426cdce
add access control in the jsonrpsee servers
niklasad1 Sep 15, 2021
a57b164
use master
niklasad1 Sep 15, 2021
085d52d
fix nits
niklasad1 Sep 15, 2021
b1d11b4
rpc runtime_version safe
niklasad1 Sep 15, 2021
a4a56d6
fix nits
niklasad1 Sep 15, 2021
fd3840d
fix grumbles
niklasad1 Sep 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
fix grumbles
  • Loading branch information
@niklasad1
niklasad1 committed Sep 15, 2021
commit fd3840dea6200aec6409eaf27c02cc49e40afcf2
8 changes: 6 additions & 2 deletions client/rpc-servers/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,14 +101,16 @@ pub fn start_http<M: Send + Sync + 'static>(

let mut acl = AccessControlBuilder::new();

log::info!("starting JSONRPC HTTP server: addr={}, cors={:?}", addr, cors);
log::info!("Starting JSONRPC HTTP server: addr={}, allowed origins={:?}", addr, cors);

if let Some(cors) = cors {
Copy link
Contributor

@dvdplm dvdplm Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't we put localhost/127.0.0.1 on the allowlist even if corse is None?

Copy link
Contributor Author

@niklasad1 niklasad1 Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All hosts/origins are enabled by default: https://github.com/paritytech/jsonrpsee/blob/master/http-server/src/access_control/mod.rs#L115

We should probably document it clearly in jsonrpsee I guess

// Whitelist listening address.
let host = Host::parse(&format!("localhost:{}", addr.port()));
Copy link
Contributor Author

@niklasad1 niklasad1 Sep 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incredible ugly and annoying, we should fix this API.

acl = acl.allow_host(host);
let host = Host::parse(&format!("127.0.0.1:{}", addr.port()));
acl = acl.allow_host(host);

// Set allowed origins.
for origin in cors {
acl = acl.cors_allow_origin(origin.into());
}
Expand Down Expand Up @@ -147,14 +149,16 @@ pub fn start_ws<M: Send + Sync + 'static>(
.max_request_body_size(max_request_body_size as u32)
.max_connections(max_connections as u64);

log::info!("starting JSONRPC WS server: addr={}, cors={:?}", addr, cors);
log::info!("Starting JSONRPC WS server: addr={}, allowed origins={:?}", addr, cors);

if let Some(cors) = cors {
// Whitelist listening address.
builder = builder.set_allowed_hosts([
format!("localhost:{}", addr.port()),
format!("127.0.0.1:{}", addr.port()),
])?;

// Set allowed origins.
builder = builder.set_allowed_origins(cors)?;
}

Expand Down