indy-tails-server icon indicating copy to clipboard operation
indy-tails-server copied to clipboard

Support Different Port for PUTs compared to GETs

Open jcourt562 opened this issue 2 years ago • 2 comments

Is it the intention that ANY credential issuer can use ANY tails file server ?

Currently there is only a single PORT configured for the tails server. GETs HAVE to be available to the public however allowing PUTs on the same port means that any issuers capable of writing a revocable registry entry to the ledger could use any ones tails file server. This seems problematic and suggests a seperate PORT should be configurable for the PUT method so that it can be protected via standard firewall protection approaches.

It may seem crazy that anyone would use a tails server they don't have control of for their credentials however it does open a potential DOS avenue depending on the cost of ledger writes.

jcourt562 avatar May 27 '22 05:05 jcourt562