Return to Ethereum ERCs

: Note: The following is an excerpt from the official Ethereum site. It is provided here as a connivence and is not authoritative. Refer to the original document as the authoritative reference.

This draft EIP describes the details of an authorization method that if provided by rpc enabled ethereum nodes would allow regular websites to send transactions (via eth_sendTransaction) without the need to enable CORS. Instead, user would be asked to confirm the transaction via an html popup.

Every read only rpc call the dapp wants to perform is redirected to an invisible iframe from the node’s domain and for every transaction that the dapp wish to execute, an html popup is presented to the user to allow him/her to cancel or confirm the transaction. This allows the dapp to connect to the node’s rpc api without being granted any kind of privileges. This allows users to safely interact with dapps running in their everyday web browser while their accounts are unlocked. In case the account is not unlocked, and the node has allowed the “personal” api via rpc,the html page also allow the user to enter their password to unlock the account for the scope of the transaction.

Currently, if a user navigates to a dapp running on a website using her/his everyday browser, the dapp will by default have no access to the rpc api for security reasons. The user will have to enable CORS for the website’s domain in order for the dapp to work. Unfortunately if the user does so, the dapp will be able to send transactions from any unlocked account without the need for any user consent. In other words, not only does the user need to change the node’s default setting, but the user is also forced to trust the dapp in order to use it. This is of course not acceptable and forces existing dapps to rely on the use of workarounds like:

• if the transaction is a plain ether transfer, the user is asked to enter it in a dedicated trusted wallet like “Mist”
• For more complex case, the user is asked to enter the transaction manually via the node command line interface.

This proposal aims to provide a safe and user friendly alternative.

Here are some screenshots of the provided implementation of that html popup: