ChainSafe / ChainSafe/lodestar
Add option to server to disable JSON responses
- Dominant language
- TypeScript
- Stars
- 1.4k
- Forks
- 483
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 150
Description
Add option to server to disable JSON responses to avoid potential DoS vector.
From https://github.com/ChainSafe/lodestar/issues/5128#issuecomment-1758069716 and moved out todos from https://github.com/ChainSafe/lodestar/pull/6749 as it is not required to be implemented as part of PR and requires more discussion / clarity on what are the expectations.
While this is quite simple to implement by updating `SUPPORTED_MEDIA_TYPES`
https://github.com/ChainSafe/lodestar/blob/8b59f500e22175d61155410db9fe587facf3e3c9/packages/api/src/utils/headers.ts#L14
it is not clear to me if we can disable json globally, because
- users might wanna query data as json (it's just simpler in a lot of cases)
- some apis do not support ssz because it's not technically possible (no json to ssz mapping), essentially disabling those completely
Since the main goal of this is to make it more difficult to DoS / crash public Lodestar nodes, we might wanna limit this to just APIs like `getStateV2` . There are also other offenders like `getStateValidators` which do not support ssz but can bring down the node quite easily.
Contributor guide
Assessment
This issue has not been assessed yet.