ChainSafe / ChainSafe/lodestar

Add option to server to disable JSON responses

Open
#6,838 2 comments 1 reaction 0 assignees View on GitHub
scope-security
Dominant language
TypeScript
Stars
1.4k
Forks
483
Avg merge
1d 16h
Merged PRs (30d)
150

Description

Add option to server to disable JSON responses to avoid potential DoS vector.

From https://github.com/ChainSafe/lodestar/issues/5128#issuecomment-1758069716 and moved out todos from https://github.com/ChainSafe/lodestar/pull/6749 as it is not required to be implemented as part of PR and requires more discussion / clarity on what are the expectations.

While this is quite simple to implement by updating `SUPPORTED_MEDIA_TYPES`
https://github.com/ChainSafe/lodestar/blob/8b59f500e22175d61155410db9fe587facf3e3c9/packages/api/src/utils/headers.ts#L14

it is not clear to me if we can disable json globally, because
- users might wanna query data as json (it's just simpler in a lot of cases)
- some apis do not support ssz because it's not technically possible (no json to ssz mapping), essentially disabling those completely

Since the main goal of this is to make it more difficult to DoS / crash public Lodestar nodes, we might wanna limit this to just APIs like `getStateV2` . There are also other offenders like `getStateValidators` which do not support ssz but can bring down the node quite easily.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.