Repository navigation
Is there any way to control access authentication for the JSON-RPC and HTTP API? #6169
Description
I have deployed a Tron node, and for security reasons, I want to implement measures to restrict access to its interfaces.
Does the Tron node have any built-in configuration that supports this functionality, or do I have to rely on additional measures like a proxy to achieve it?
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
abn2357 commentedon Feb 12, 2025
No built-in configuration
SeriousCoding789 commentedon Feb 14, 2025
As far as I can see, currently java-tron itself only provide rate and connect limits. You could find them in config file.
halibobo1205 commentedon Feb 17, 2025
https://besu.hyperledger.org/public-networks/how-to/use-besu-api/authenticate, JSON-RPC authentication @eodiandie. We could give it a try.
waynercheung commentedon Feb 18, 2025
Hi,
I think this is a great proposal and I’m quite interested in it.
I previously raised an issue related to JSON-RPC, and we can develop the authentication functionality for the JSON-RPC interface together.
waynercheung commentedon Feb 27, 2025
According to the document mentioned above, besu supports two authentication methods:
I think we can supports these two methods for Tron.
Besides that, I will do some search to find if there is a specification about the authentication for eth jsonrpc apis.
PikaZ76 commentedon Mar 1, 2025
@waynercheung that's great! it's could be better if Tron get build-in authentication !
waynercheung commentedon May 28, 2025
Yes, let's talk about the detailed solution later.
waynercheung commentedon Jul 28, 2025
Thanks for the ongoing discussion. This is complex and needs deeper research to get right. Our next substantial update is around September 10th. We’ll share progress in upcoming developer meetings—watch for announcements. The issue stays open. We value community input, so please share insights, approaches, or suggestions in comments. All ideas are welcome.
waynercheung commentedon Sep 28, 2025
The 4.8.1 release is requiring more time than expected to properly test and finalize. Let us circle back to review this issue once the 4.8.1 release is complete and we can dedicate proper attention to it.
ferdinand026 commentedon Mar 19, 2026
Any updates on this? Is there a planned roadmap for the implementation? Thanks!
waynercheung commentedon Mar 20, 2026
@ferdinand026 Thanks for your patience. This issue is still under active investigation. We will provide an update as soon as we have more findings to share.
waynercheung commentedon May 15, 2026
Quick update @PikaZ76 - this is still on my radar. I've been comparing how other Ethereum clients handle JSON-RPC auth (Geth / Besu / Erigon), and the leading direction for java-tron looks like optional JWT bearer auth on HTTP & JSON-RPC, similar to the Engine API scheme. I'll post a concrete proposal here once it's ready. Thanks for your patience.
halibobo1205 commentedon May 15, 2026
Closing for now — tracked in #6497 going forward. Thanks @waynercheung @PikaZ76. cc @317787106