indy-tails-server
indy-tails-server copied to clipboard
Support Different Port for PUTs compared to GETs
Is it the intention that ANY credential issuer can use ANY tails file server ?
Currently there is only a single PORT configured for the tails server. GETs HAVE to be available to the public however allowing PUTs on the same port means that any issuers capable of writing a revocable registry entry to the ledger could use any ones tails file server. This seems problematic and suggests a seperate PORT should be configurable for the PUT method so that it can be protected via standard firewall protection approaches.
It may seem crazy that anyone would use a tails server they don't have control of for their credentials however it does open a potential DOS avenue depending on the cost of ledger writes.