xud
xud copied to clipboard
ExchangeUnion
Use macaroons for grpc authentication
Currently there's no authentication on rpc calls. This issue tracks using macaroons for securing rpc calls. We'll need to generate macaroons on startup if none exist.
The most mature macaroons implementation for javascript appears to be https://github.com/nitram509/macaroons.js, however it has not been updated in over a year and there are apparently issues with its type definitions. We should consider forking that project and fixing the type definitions.
Note: This will necessarily be a breaking change as far as the swap-resolver code goes, so we'll need to coordinate this with changes to swap-resolver logic.
since it'll be breaking changes rather sooner than later? I put it into the next milestone for now, let me know if you'd push it one further @sangaman @offerm
Yeah that's true, I figure we should definitely support a nomacaroons mode to make testing easier but it's still breaking in that we'd need to add that arg for current behavior to continue working. I'll take a look at this next week.
@offerm anything to add from your side? Preferably we do this now since breaking changes and alpha.3 should be the first version we distribute to some exchanges
I'm not sure about the need. I think in most cases the RPC will be used from a local machine and the access to the macaroons file will be automatic by looking for the XUD working directory.
Having said that, I don't see it as an issue to have it now.
Suggest to support nomacaroons option and make it the default until the swap-resolver /simnet is ready for macaroon usage.
Hmm not sure if nomacaroons as temporary default makes sense since once we switch to default it will break things. Push to next milestone to give @offerm some time to fix simnet? @sangaman
@kilrau nomacaroons is our current setup, right?
switching to macarons is the breaking change.
My suggestion is to add macaron support while keeping current defalt (nomacaroon), check it, switch to macaroons on simnet, and when everything is working, make it the default.
Yeah I was also planning on starting with nomacaroons as defaulting to true.
Maybe we could use this library: https://github.com/go-macaroon/js-macaroon
As discussed, it would make sense to have separate macaroons with access to different sets of rpc calls. A simple breakdown would be one macaroon with access to all calls and another with access to strictly read-only calls (GetInfo, ListOrders, etc...).
