go-ethereum web3js security – Can an account be unlocked using JSON-RPC?

go-ethereumjavascriptjson-rpcSecurityweb3js

The only way I can work with ETH is through --rpc mode. Normally I would prefer to use the Python interface.

But I found myself in a situation where the RPC is very limited. For example, I can't create or unlock an account.

Are these all the available JSON-RPC methods or are they just not well documented?

Should I maybe switch to Javascript and use the JavaScript-API?

Best Answer

RPC over HTTP is inherently unsafe, as any browser tab may access your server. Because of this, any functionality that was deemed unsafe for public consumption is not available by default on the HTTP interface.

You have two options: you can either force enable the things you're missing via --rpcapi, just make sure you're clear with the security consequences. The other and better solution is to do API requests via the IPC channel, which has all methods enabled by default.

For a full list of Geth 1.3.x management methods see https://github.com/ethereum/go-ethereum/wiki/Go-ethereum-management-API's . This list will be significantly expanded with the 1.4 release.

Related Topic