Read-only API calls are accepted on the gateway port

[MichaelMure]

Version information:

0.4.23 and master

Description:

$ ipfs daemon &
...
API server listening on /ip4/127.0.0.1/tcp/5001
Gateway (readonly) server listening on /ip4/127.0.0.1/tcp/8080

$ curl 127.0.0.1:8080/api/v0/version
{"Version":"0.5.0-dev","Commit":"be505da39","Repo":"9","System":"amd64/linux","Golang":"go1.14"}

$ curl 127.0.0.1:8080/api/v0/ls?arg=QmUyqSdF5V5pSDmwDHmyAU42xojqu5RuD59KRaa6WvxCm7
{"Objects":[{"Hash":"QmUyqSdF5V5pSDmwDHmyAU42xojqu5RuD59KRaa6WvxCm7","Links":[]}]}

Excerpt of the config:

  "Addresses": {
    "API": "/ip4/127.0.0.1/tcp/5001",
    "Announce": [],
    "Gateway": "/ip4/127.0.0.1/tcp/8080",
    "NoAnnounce": [],
    "Swarm": [
      "/ip4/0.0.0.0/tcp/4002",
      "/ip6/::/tcp/4002"
    ]
  },

Digging further this seems to be intentional (#1389) but is this really something that should be kept ? What about a config to disable this behavior ?

[Stebalien]

This is a feature. It allows DAPPs served from a gateway to make read-only requests against the daemon. We can make it optional if it's an issue.

What's your motivation for disabling it?

[MichaelMure]

No necessarily an issue for Infura as we filter those in our reverse proxy but that's a surprising behavior (I had no idea even though I followed IPFS for a long time).

The idea of making it configurable is twofold:

• it allows gateway operator to disable the behavior if they don't want it
• it raises the awareness about this by being part of heavily read part of the documentation

Feel free to dismiss this issue, it's just a sort of feedback.

[hsanjuan]

Thanks, I suppose we can accept contributions to make this configurable (and document the behaviour).

[lidel]

Removed in #10352