ipfs/public-gateway-checker

Want to run a gateway for loading web apps? Make sure it provides origin isolation.

lidel opened this issue · 12 comments

lidel commented

We've made the Origin check more prominent in #148:

  • If you don't know why Origin isolation matters, a good primer is at https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy
  • If you care about security of websites loaded via your gateway, consider converting it to subdomain gateway (see config docs and recipes for go-ipfs). Gateways without origin isolation are now marked with ⚠️ sign, indicating they are not safe for use cases that require origin isolation.
    • FYSA we will disable local storage, cookies and some Web APIs on the path gateway in the near future (ipfs/in-web-browsers#157), effectively forcing use of subdomain gateways in situations where a dapp or website requires credentials, local storage persistence and/or access to web APIs.
    • This is a heads-up to migrate before this becomes a problem for your use case.
lidel commented

Pinging folks who added a gateway to the list in the past, for additional visibility:
@ntninja @go69 @HamedSepehr @aphelionz @joshfraser @obo20 @arhuman @Kcchouette @albertorositani @Jorropo @fooock @cwchristerw @jonaharagon @swedneck @herronjo @meehow @sixcorners @cofeein @SaltyLeo @didnt1able @SIUU @k1ic @weaming @ahmaks @lizelive @FireMasterK @carsenk @plibither8 @xmaysonnave @zikunfan @hybla0 @noormohammedb @CryptoZifter @Mas7erMind @ipfsgate @itargowoosung @gavfu @ivoputzer @Jeroen52

This is a PSA. If you have questions regarding subdomain gateway configuration:

Kcchouette commented

Hello, I don't own gateway, only contributing by adding some I find on the Internet

  • 👍1
Jorropo commented

Thx for the ping, I'm in the process to enable it (I recently moved my dns to self hosted for simpler ACME challenges).

I want still to point out that there are legit and safe use case for non origin isolated gateways.
I get about 1 request per second. Most of them are from webtorrent webseeds, or other use cases where my gateway just serve files.
So the website is on an other isolated gateway and it embeds ressources from mine (hopefully using webtorrent or integrity atributes). (Origin isolated gateways could also do the same just fine)

  • 👍2
aphelionz commented

Thanks @lidel

Anybody know a good domain registrar that will allow me to have a wildcard domain? I'll start the transfer process ASAP if somebody can recommend a good one.

lidel commented

@aphelionz every DNS registrar should support wildcard domain names, but if you are looking for a cheap one https://www.cloudflare.com/products/registrar/ usually has the lowest renewal rates.

  • 👍3
Jorropo commented

@aphelionz every DNS registrar should support wildcard domain names, but if you are looking for a cheap one cloudflare.com/products/registrar usually has the lowest renewal rates.

At worst if it doesn't you can just setup your own BIND9 servers and just point the NS domains onto them.

cwchristerw commented

I have hosted IPFS in specific subdomain before using Path Gateway. I'm not sure if I'm going to start using Subdomain gateway because previously it caused my servers to run out of memory.

weaming commented

image

Implemented Origin isolation for IPFS!

Use Cloudflare + Let's Encryption (acme.sh) + nginx.

  • 👍2
  • 🚀1
lidel commented

@cwchristerw There should be no meaningful difference in memory use between path and subdomain gateways – the cause of your issues is most likely elsewhere. if you want to find the cause, go-ipfs/docs/debug-guide.md will be useful, then fill issue against https://github.com/ipfs/go-ipfs

cwchristerw commented

@lidel Yeah it was typo 😄 I was meant to say that currently my gateway is offline because IPFS used too much memory 😄

SgtPooki commented

I think we could link to this from the README and then close. open to PR for that from anyone. (or I will get to it)

lidel commented

iirc I kept it open only as a PSA, we can just close this: