Eclair v0.14.4 Blocks Browser Requests to Lightning Node API
Photo: TokenPost
Eclair’s v0.14.4 update blocks browser requests from reaching its Lightning node API, closing a path that could let a webpage trigger authenticated commands such as channel changes or payments. Released Oct. 15, the update returns HTTP 403 for any API request carrying an Origin header before the request reaches an endpoint. The API can read node state, open or close payment channels and send or receive payments. The risk involved HTTP Basic authentication: a browser could attach cached credentials to a form submitted from another website. Although the page could not read the response, the requested command could still run.
Source: TokenPost
