Search code examples
securityblockchainethereumgo-ethereum

geth option "--allow-insecure-unlock", what exactly does it mean?

The doc on github says:

--allow-insecure-unlock Allow insecure account unlocking when account-related RPCs are exposed by http

And, I have to add the option when start geth, otherwise can't unlock the account.

Questions

  • What does this option exactly mean? I read the doc and searhed on Google, still can't fully understand it.
  • Is it safe to use this option, will it create security holes?
Solution

  • If you access to a node with geth via HTTP protocol you can´t unlock account with personal.unlockAccount(web3.eth.account, password). If you try, you'll receive error "account unlock with HTTP access is forbidden". So, to avoid that you have to use the flag allow-insecure-unlock.

    That is because the unlock operation is unsafe if the node is exposed to external. That "protection" was added in go-ethereum in PR #17037 (https://github.com/ethereum/go-ethereum/pull/17037)