starlog Daemon security

the readme says:

Make sure your ipfs daemon is running with API_ORIGIN set to '*', and using --unrestricted-api:

this is really, really bad. users should not be advised to do this. if developers are asked to do this, note the dangers.

Sep 14 '15 05:09 jbenet

Fair point, will add warning bells

Sep 14 '15 14:09 krl

@jbenet Do we have any text i could link that talk about why this is dangerous?

Sep 14 '15 14:09 krl

#27

Sep 14 '15 14:09 krl

not yet

Sep 14 '15 16:09 jbenet

@krl I'm not yet that deep into how the ipfs admin interface works (so this could be wrong), but by running

ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["*"]'
ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '["PUT", "GET", "POST"]'
ipfs config --json API.HTTPHeaders.Access-Control-Allow-Credentials '["true"]'

you're effectively disabling the Same Origin Policy and allow any website you visit to control your local ipfs daemon.

(If found this snippet by running ipfs daemon --help looking for docs what exactly --unrestricted-api does, maybe there should be a warning, too)

If there's interest I could investigate further and write up something for the docs repo.

Sep 18 '15 22:09 kpcyrd