Eclair, the Lightning node software from ACINQ, shipped v0.14.4 on Oct. 15 with a fix for a browser-based attack path. The issue could let a malicious webpage send authenticated commands to an operator’s Lightning node if the node API was reachable from the browser and HTTP Basic credentials were already cached. That is a narrow setup, but the result was serious: the API can read node state, open and close channels, and send or receive payments.
What changed
The patch blocks requests that carry an Origin header. If that header is present, Eclair returns HTTP 403 before the API route runs. The value of the header does not matter under the new rule. The release notes explain the original problem: a malicious page could submit a plain HTML form to the node API, and the browser would attach saved credentials automatically. The attacker could not read the response, but the command could still reach the node.
That fix has a tradeoff. Legitimate browser interfaces now hit the same wall, including frontends hosted at the same origin as the API. Those interfaces need an intermediary backend between the browser and Eclair. Command-line tools are not affected. The maintainers say curl and eclair-cli do not send the Origin header, so their normal API requests still work.
Why the Origin check matters
The change closes one browser path, not every gap. Authentication and network restrictions still matter. A non-browser client can leave out the Origin header, so a missing header does not prove a request is authorized. Eclair maintainer pm47 says the API should stay bound to loopback, which limits network access to the local machine. I think that advice is easy to overlook, perhaps because the browser fix sounds like a complete answer. It is not.
What operators should do
The browser fix was merged on Sept. 15 in pull request #3380. It arrives in v0.14.4 alongside the funding-fee and signer repairs CryptoSlate covered on Oct. 12. Maintainers recommend upgrading. Operators can stop Eclair, install the update, and restart without closing Lightning channels.
For node runners using a browser frontend, the backend step is now part of the upgrade. Check whether the API is exposed beyond loopback. Confirm that any web interface has a server-side layer in front of it. And treat the Origin check as one control among several, not a replacement for auth or careful network setup.
The post Eclair v0.14.4 blocks browser-origin commands to Lightning nodes appeared first on TheCryptoUpdates .
