Eclair 0.14.4 answers 403 to any API call that arrives with an Origin header. It doesn't look at what the origin is, only whether there is one. Eclair's API uses basic auth and takes form-encoded parameters, so once a browser has cached the password, a plain HTML form on any page the operator opens can POST to it. That needs no CORS approval. The page can't read the reply, but the on-chain send or channel close has already gone through. Browsers set Origin on those requests and curl doesn't, and checking for presence also catches the Origin: null a sandboxed iframe sends. The fix was merged on 15 September, a day after 0.14.3 was tagged, and shipped on 15 October. phoenixd, from the same team, also takes form-encoded parameters behind basic auth, and I can't find an Origin check anywhere in 0.9.3. Is there a reason phoenixd doesn't need one, or hasn't it come up yet?
Muhammad AzharShare
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.