The add api has no limit? about go-btfs HOT 3 CLOSED

There is no built-in permission control at the moment. You should keep the api port protected or restrict cors through "Access-Control-Allow-Origin" in your ~/.btfs/config:

"Gateway": {
    "APICommands": [],
    "HTTPHeaders": {
      "Access-Control-Allow-Headers": [
        "X-Requested-With",
        "Range",
        "User-Agent"
      ],
      "Access-Control-Allow-Methods": [
        "GET"
      ],
      "Access-Control-Allow-Origin": [
        "*"
      ]
    },
    "NoFetch": false,
    "PathPrefixes": [],
    "RootRedirect": "",
    "Writable": false
},

from go-btfs.

Looks like the api can only be accessed locally?

API server listening on /ip4/127.0.0.1/tcp/5001
WebUI: http://127.0.0.1:5001/webui
Gateway (readonly) server listening on /ip4/127.0.0.1/tcp/8080
Remote API server listening on /ip4/127.0.0.1/tcp/5101

I tried to access the 8080 port out of the vm and it failed...

from go-btfs.

@samohyes thats correct, the api will only listen to locally by default. if you do a btfs config show and view the Address, API settings it has the 127.0.0.1 by default. the settings is a multiaddr format. thanks.

from go-btfs.