Unsafe RPC calls?

Question

I wonder why most substrate nodes have that --unsafe-rpc-external flag and which of the calls are actually unsafe. Is there a RPC documentation somewhere?

Answer 1

These flags allow you to expose the RPC interfaces publicly:

--unsafe-rpc-external
  Listen to all RPC interfaces.
            
  Same as `--rpc-external`.

--rpc-external
  Listen to all RPC interfaces.
            
  Default is local. Note: not all RPC methods are safe to be exposed publicly. Use an RPC proxy server to filter out dangerous methods. More details: <https://docs.substrate.io/v3/runtime/custom-rpcs/#public-rpcs>. Use
   `--unsafe-rpc-external` to suppress the warning if you understand the risks.

By default, the node will refuse to start if you try to expose an RPC interface and run a validator node at the same time. The --unsafe-* flags allow you to suppress this security measure. Exposing RPC interfaces can open up a huge surface of attacks and has to be carefully reviewed.

Read more:

• https://docs.substrate.io/main-docs/build/custom-rpc