{
"subject": "JSON-RPC password",
"content": {
"format": "html",
"body": "<div class=\"post\">I uploaded to SVN my changes to add a password to JSON-RPC. If you're set up to build, please test it.<br/><br/>The -server switch is replaced with -rpcpw=<password>, which is also used with bitcoind.<br/>bitcoin -rpcpw=<password> -- runs with JSON-RPC port open<br/>bitcoind -rpcpw=<password> -- daemon with password<br/><br/>If you have a better idea for the switch name, let me know, but keep in mind there will eventually be a password for encrypting the database too. I'm not sure but I think they may want to use different passwords for the two.<br/><br/>It gives a warning if you don't set a password.<br/><br/>All commands now require the password as the first parameter. It'll tell you that if you run \"bitcoind help\".<br/><br/>The central code:<br/><br/> // Check password<br/> if (params.size() < 1 || params[0].type() != str_type)<br/> throw runtime_error(\"First parameter must be the password.\");<br/> if (params[0].get_str() != strRPCPassword)<br/> {<br/> if (strRPCPassword.size() < 15)<br/> Sleep(50);<br/> begin = strRequest.end();<br/> printf(\"ThreadRPCServer incorrect password attempt\n\");<br/> throw runtime_error(\"Incorrect password.\");<br/> }<br/><br/>Any comments on these decisions?<br/><br/>1) if (strRPCPassword.size() < 15) Sleep(50); -- this means if it's a short password, it'll wait 50ms after each attempt. This might be used as a DoS attack, but I figured if it's a short password, it's more important to protect against brute force password scan. This may tell outsiders whether the password is less than 15 characters, but less than 15 isn't all that noteworthy, most passwords are less than 15. If you want to close the DoS possibility, just use a password 15 characters or longer.<br/><br/>2) begin = strRequest.end(); -- if it's a single request with multiple invocations, I throw away the rest if one has a bad password. This is so you can't stuff it with millions of password attempts in one packet. What do you think, is this the right thing to do? (multiple invocation is probably almost never used anyway)<br/><br/>I also fixed the two duplicated commands listed in the help:<br/><br/>getaddressesbylabel <pw> <label><br/>getbalance <pw><br/>getblockcount <pw><br/>getblocknumber <pw><br/>getconnectioncount <pw><br/>getdifficulty <pw><br/>getgenerate <pw><br/>getinfo <pw><br/>getlabel <pw> <bitcoinaddress><br/>getnewaddress <pw> [label]<br/>getreceivedbyaddress <pw> <bitcoinaddress> [minconf=1]<br/>getreceivedbylabel <pw> <label> [minconf=1]<br/>help <pw><br/>listreceivedbyaddress <pw> [minconf=1] [includeempty=false]<br/>listreceivedbylabel <pw> [minconf=1] [includeempty=false]<br/>sendtoaddress <pw> <bitcoinaddress> <amount> [comment] [comment-to]<br/>setgenerate <pw> <generate> [genproclimit]<br/>setlabel <pw> <bitcoinaddress> <label><br/>stop <pw><br/></div>"
},
"source": {
"name": "Bitcoin Forum",
"url": "https://bitcointalk.org/index.php?topic=461.msg4059#msg4059"
},
"date": "2010-07-18T20:49:22Z"
}