Daemon security

[jbenet]

the readme says:

Make sure your ipfs daemon is running with API_ORIGIN set to '*', and using --unrestricted-api:

this is really, really bad. users should not be advised to do this. if developers are asked to do this, note the dangers.

[krl]

Fair point, will add warning bells

[krl]

@jbenet Do we have any text i could link that talk about why this is dangerous?

[krl]

#27

[jbenet]

not yet

[kpcyrd]

@krl I'm not yet that deep into how the ipfs admin interface works (so this could be wrong), but by running

ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["*"]'
ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '["PUT", "GET", "POST"]'
ipfs config --json API.HTTPHeaders.Access-Control-Allow-Credentials '["true"]'

you're effectively disabling the Same Origin Policy and allow any website you visit to control your local ipfs daemon.

(If found this snippet by running ipfs daemon --help looking for docs what exactly --unrestricted-api does, maybe there should be a warning, too)

If there's interest I could investigate further and write up something for the docs repo.