Requirement company firewall: Fixed Beacon-Node URL

[jdsika]

Hi Team,

I am having the following issue when trying to use beacon (indepentend from applications):
The node url changes periodically and I have to apply for a firewall exception each time at BMW.

The same way as the magic link for tzBTC was changed to a single url I would need it here:
Current: https://beacon-node-1.beacon-server-1.papers.tech/_synapse/client/beacon/info
example: https://beacon-node.papers.tech/_synapse/client/beacon/info

My error:

Quellübergreifende (Cross-Origin) Anfrage blockiert: Die Gleiche-Quelle-Regel verbietet das Lesen der externen Ressource auf https://beacon-node-1.beacon-server-1.papers.tech/_synapse/client/beacon/info. (Grund: CORS-Anfrage schlug fehl). Statuscode: (null).

[jdsika]

This is high priority for me. Can you please have a look at it?

[AndreasGassmann]

Hi @jdsika, sorry for the late reply.

I understand the error you have regarding the changing URL and having to allowlist them all. But I don't understand where you get the CORS error. CORS errors can often "mistakenly" appear if a server cannot be reached, which seems to be the case in those networks you are talking about.

Sadly, I don't know how we can solve this "allowlist" problem, other than adding all the URLs to the allowlist.

The reason why there is sometimes a new node/URL selected is because the beacon-sdk automatically runs a test on pageload about which server (or servers in a region) responds fastest. And that node will be selected automatically.

Another problem is that we cannot add a load balancer for those servers, even if we wanted to. When registering or logging in to the beacon-network, the actual server-name is part of the username. So if you select eg. beacon-node-1.hope.papers.tech as your server, it will log you in as <key>.beacon-node-1.hope.papers.tech. This suffix needs to match the name of the server, otherwise the login will fail. If we added a load-balancer, then the name of the load-balancer-URL would be used as a server-name, and it would not work. The reason why this is is because beacon is built on top of the matrix protocol, and matrix requires users to be registered on one "homeserver", and accounts can not be transferred from one to another homeserver.

To summarise, I currently cannot think of a solution that we can implement on the sdk-level. One of the main features of beacon is that the network is decentralised, so it is possible and necessary for many different servers to exist. We're open for any ideas that you have, but currently the only thing I see would be to add all the servers from https://beacon-node-1.beacon-server-1.papers.tech/_synapse/client/beacon/info to the allowlist (this should work for now because they don't change frequently).

[jdsika]

ok, would it be possible to configure a fixed "homeserver" in the application and maybe one backup in order to tell users "if you have issues please allow those two https connections"?

[jdsika]

Where is the list of possible beacon nodes in order to whitelist all nodes?

[AndreasGassmann]

Those are the nodes currently in use. At the moment there are no plans to add more servers to the list.

const beaconNodes = [
    'beacon-node-1.diamond.papers.tech',
    'beacon-node-1.sky.papers.tech',
    'beacon-node-2.sky.papers.tech',
    'beacon-node-1.hope.papers.tech',
    'beacon-node-1.hope-2.papers.tech',
    'beacon-node-1.hope-3.papers.tech',
    'beacon-node-1.hope-4.papers.tech',
    'beacon-node-1.hope-5.papers.tech',
    'beacon-node-1.beacon-server-1.papers.tech',
    'beacon-node-1.beacon-server-2.papers.tech',
    'beacon-node-1.beacon-server-3.papers.tech',
    'beacon-node-1.beacon-server-4.papers.tech'
]

Additionally, if the wallet is using the WalletConnect transport (eg. TrustWallet or Kukai Mobile), then it will try to connect to wss://relay.walletconnect.com.

ok, would it be possible to configure a fixed "homeserver" in the application and maybe one backup in order to tell users "if you have issues please allow those two https connections"?

The dApp can always define which servers it should use. Just keep in mind that this would apply to every user of the dApp and would make the overall experience worse (because it would no longer select the best server for the region the user is in).

[jdsika]

I would recommend to add this list to the documentation with a note regarding firewall settings? Afterwards we can close the issue as I understand that there is no technical solution - except for aiming for one like with wallet connect