Grégory avatar

Increasing SteemConnect security

gregory.latinier

Published: 08 May 2018 › Updated: 08 May 2018Increasing SteemConnect security

Increasing SteemConnect security

Hello Steem developers and SteemConnect users,

Project: SteemConnect, Pull Request

This PR is about increasing security of SteemConnect apps by adding a server IPs restriction.

Please type in this field the IPs of your servers that will be allowed to use SteemConnect API refresh token calls. When using an refresh token, we'll now check the app linked to this token and check if the server where the request is coming from is allowed.

You can leave this field blank but I don't recommend it especially if you're app is running in production and using offline access.

This security layer will prevent stolen tokens from being used on a server that you don't control. But this we not stop malicious code from being executed from your server. That is your responsibility.

Lastly if you're the owner of an app please take the time to increase your app security. Below is the list of all app owner that we know. If you find your name that means you own an app. So please take the time to update your app if it's running in production.

App's owner list:

aarontengHive account@aaronteng, abhishekvaidHive account@abhishekvaid, adoelesteemHive account@adoelesteem, air-clinicHive account@air-clinic, airhawk-exchangeHive account@airhawk-exchange, akintundeHive account@akintunde, alaingoldHive account@alaingold, alexvergeHive account@alexverge, aleyHive account@aley, anarcotechHive account@anarcotech, andreistalkerHive account@andreistalker, andrekwekuHive account@andrekweku, andybetsHive account@andybets, aneilpatelHive account@aneilpatel, anonycoinHive account@anonycoin, ansekHive account@ansek, anthonyadavisiiHive account@anthonyadavisii, aquacyHive account@aquacy, arsteemHive account@arsteem, asbearHive account@asbear, asgarthHive account@asgarth, azaanwritesHive account@azaanwrites, azarusHive account@azarus, bennierexHive account@bennierex, betelHive account@betel, biddleHive account@biddle, binjeeclickHive account@binjeeclick, binkleyHive account@binkley, birdincHive account@birdinc, blockchanHive account@blockchan, bloque64Hive account@bloque64, bostrotHive account@bostrot, br3adina7orHive account@br3adina7or, cadawgHive account@cadawg, callahanHive account@callahan, cdhexxHive account@cdhexx, cha0s0000Hive account@cha0s0000, christianjomboHive account@christianjombo, clevershovelHive account@clevershovel, cloh76Hive account@cloh76, codewithcheeseHive account@codewithcheese, comsamoHive account@comsamo, creative-commonsHive account@creative-commons, crowdiniHive account@crowdini, crypticwyrmHive account@crypticwyrm, cryptocrusadersHive account@cryptocrusaders, cryptogeckoHive account@cryptogecko, cryptosharonHive account@cryptosharon, crypto.talkHive account@crypto.talk, cryptouruHive account@cryptouru, damaeraHive account@damaera, darkflameHive account@darkflame, debraycodesHive account@debraycodes, decebal2dacHive account@decebal2dac, decentmemesHive account@decentmemes, deimusHive account@deimus, demotrukHive account@demotruk, dgamesHive account@dgames, dhealthHive account@dhealth, disregardfiatHive account@disregardfiat, doctor.fishHive account@doctor.fish, doctorveeHive account@doctorvee, doreami93Hive account@doreami93, dporncoHive account@dpornco, dragosrouaHive account@dragosroua, duniteHive account@dunite, dwarrilow2002Hive account@dwarrilow2002, eastmaelHive account@eastmael, eddy-ghostHive account@eddy-ghost, eleganceHive account@elegance, emrebeylerHive account@emrebeyler, enki74Hive account@enki74, ercuHive account@ercu, eternittyyyHive account@eternittyyy, ety001Hive account@ety001, ewqHive account@ewq, excitedntlHive account@excitedntl, fabienHive account@fabien, feekayoHive account@feekayo, fel1xwHive account@fel1xw, ferviHive account@fervi, firedreamHive account@firedream, fodeHive account@fode, franky4ditaHive account@franky4dita, franticichHive account@franticich, freetissuesHive account@freetissues, funnymanHive account@funnyman, gamelandHive account@gameland, gangzeHive account@gangze, gentlemanoiHive account@gentlemanoi, geronimoHive account@geronimo, gktownHive account@gktown, gokulnkHive account@gokulnk, good-karmaHive account@good-karma, gregory.latinierHive account@gregory.latinier, guix77Hive account@guix77, hakancelikHive account@hakancelik, harjukyHive account@harjuky, harpagonHive account@harpagon, heimindangerHive account@heimindanger, heloHive account@helo, heriadiHive account@heriadi, hernandevHive account@hernandev, hightouchHive account@hightouch, howoHive account@howo, hoxlyHive account@hoxly, hrockHive account@hrock, hsynterkrHive account@hsynterkr, hui.zhaoHive account@hui.zhao, hyperspaceonlineHive account@hyperspaceonline, iamankitHive account@iamankit, icaroHive account@icaro, idlebrightHive account@idlebright, igsterHive account@igster, iguazi123Hive account@iguazi123, ikidnapmyselfHive account@ikidnapmyself, imlikettHive account@imlikett, inertiaHive account@inertia, instituteHive account@institute, jacobyuHive account@jacobyu, jakipatrykHive account@jakipatryk, jakipatryk-devHive account@jakipatryk-dev, jalasemHive account@jalasem, jamzedHive account@jamzed, jefftHive account@jefft, jefpatatHive account@jefpatat, jeonghckr7Hive account@jeonghckr7, jes2850Hive account@jes2850, jestemkioskiemHive account@jestemkioskiem, jlebrijoHive account@jlebrijo, jm90mmHive account@jm90mm, jmsofarelliHive account@jmsofarelli, jnmarteauHive account@jnmarteau, johnesanHive account@johnesan, jrawsthorneHive account@jrawsthorne, juicerHive account@juicer, jungsHive account@jungs, justinadamsHive account@justinadams, kellyjandersonHive account@kellyjanderson, kennybllHive account@kennybll, kirkinsHive account@kirkins, kizzbonezHive account@kizzbonez, klyeHive account@klye, knowledgesHive account@knowledges, koinbotHive account@koinbot, kryptoniaHive account@kryptonia, kwlvarunHive account@kwlvarun, kws4679Hive account@kws4679, lanmowerHive account@lanmower, leap8Hive account@leap8, leebs1986Hive account@leebs1986, letseatHive account@letseat, leventsaneHive account@leventsane, lightprojectHive account@lightproject, lopezdacruzHive account@lopezdacruz, lrmediaHive account@lrmedia, mafouaniHive account@mafouani, mahdiyariHive account@mahdiyari, markangeltruemanHive account@markangeltrueman, martibisHive account@martibis, maxgHive account@maxg, maxseHive account@maxse, mburakolgunHive account@mburakolgun, memeit.lolHive account@memeit.lol, minnowhelperteamHive account@minnowhelperteam, mktHive account@mkt, modenacookHive account@modenacook, moonriseHive account@moonrise, morningHive account@morning, mowilimiHive account@mowilimi, mungprikHive account@mungprik, mysHive account@mys, nareshbalajiHive account@nareshbalaji, newmoney32601Hive account@newmoney32601, nhj12311Hive account@nhj12311, nicniezgrublemHive account@nicniezgrublem, nikemaHive account@nikema, nirgfHive account@nirgf, nnnarvaezHive account@nnnarvaez, noisy2Hive account@noisy2, notakuHive account@notaku, ocdbHive account@ocdb, okcHive account@okc, olegnHive account@olegn, olo2552Hive account@olo2552, omeratagunHive account@omeratagun, orineHive account@orine, orogerHive account@oroger, oudekaasHive account@oudekaas, oupsHive account@oups, overmediaHive account@overmedia, pankajwahaneHive account@pankajwahane, paolobenefortiHive account@paolobeneforti, peerqueryHive account@peerquery, peneincHive account@peneinc, perdutaHive account@perduta, pharesimHive account@pharesim, planetenamekHive account@planetenamek, pranishgHive account@pranishg, precise.botHive account@precise.bot, predictevHive account@predictev, prenaioHive account@prenaio, profchydonHive account@profchydon, programminghubHive account@programminghub, purecHive account@purec, puzzledbythewebHive account@puzzledbytheweb, qny37Hive account@qny37, r351574nc3Hive account@r351574nc3, ragepeanutHive account@ragepeanut, rahulspsHive account@rahulsps, ranamuneebHive account@ranamuneeb, reazuliqbalHive account@reazuliqbal, recrackHive account@recrack, reggaemuffinHive account@reggaemuffin, resteemableHive account@resteemable, revoHive account@revo, rileygeHive account@rileyge, rishi556Hive account@rishi556, robin-makiHive account@robin-maki, robinronHive account@robinron, ryanli827Hive account@ryanli827, sahidmillerHive account@sahidmiller, sailei1Hive account@sailei1, sakujoHive account@sakujo, salajroHive account@salajro, sambillinghamHive account@sambillingham, samrg472Hive account@samrg472, schererfHive account@schererf, scorum.communityHive account@scorum.community, scottwestonHive account@scottweston, sdavignonHive account@sdavignon, sean0010Hive account@sean0010, sedatyildizHive account@sedatyildiz, segyeparkHive account@segyepark, selectedHive account@selected, senkuHive account@senku, sevenfingersHive account@sevenfingers, shangoHive account@shango, shaunmzaHive account@shaunmza, shiningpilHive account@shiningpil, sidibeatHive account@sidibeat, sigmundfreudHive account@sigmundfreud, sircorkHive account@sircork, sjworldHive account@sjworld, skenanHive account@skenan, sly13Hive account@sly13, smartsteemHive account@smartsteem, smjnHive account@smjn, snwolakHive account@snwolak, soulastHive account@soulast, spmarketsHive account@spmarkets, steem4keysHive account@steem4keys, steemalienHive account@steemalien, steemanswerHive account@steemanswer, steemcreateHive account@steemcreate, steemcurveHive account@steemcurve, steemdeskHive account@steemdesk, steemfairHive account@steemfair, steemgigsHive account@steemgigs, steemhelper.comHive account@steemhelper.com, steemhuntHive account@steemhunt, steemicHive account@steemic, steemit-casinoHive account@steemit-casino, steemitgame.devHive account@steemitgame.dev, steemit.lolHive account@steemit.lol, steemizHive account@steemiz, steempedia.comHive account@steempedia.com, steempostitaliaHive account@steempostitalia, steempunknetHive account@steempunknet, steemraiseHive account@steemraise, steemvidsHive account@steemvids, stoodkevHive account@stoodkev, supaheftyHive account@supahefty, supergamerHive account@supergamer, svosseHive account@svosse, sweeverHive account@sweever, syedumairHive account@syedumair, talhaschHive account@talhasch, taskmanagerHive account@taskmanager, tasteemHive account@tasteem, t-botHive account@t-bot, techchatHive account@techchat, tensorHive account@tensor, testbedHive account@testbed, tevo200Hive account@tevo200, theoldnavyHive account@theoldnavy, thiagosouzaHive account@thiagosouza, thornaciHive account@thornaci, timothy-meeHive account@timothy-mee, tonychchHive account@tonychch, touhidalam69Hive account@touhidalam69, tpdns90321Hive account@tpdns90321, trayHive account@tray, twittertipperHive account@twittertipper, ubgHive account@ubg, ukuleletutorialsHive account@ukuleletutorials, upheaverHive account@upheaver, upmewhaleHive account@upmewhale, utopian-ioHive account@utopian-io, vallesleorutherHive account@vallesleoruther, vhinojosaHive account@vhinojosa, walnut1Hive account@walnut1, wehmoenHive account@wehmoen, wonki33Hive account@wonki33, wordchaseHive account@wordchase, x30Hive account@x30, yabapmattHive account@yabapmatt, yulemHive account@yulem, zakiiiHive account@zakiii, zemsoHive account@zemso, zenklyHive account@zenkly, zombeeHive account@zombee, zonguinHive account@zonguin, zygiboHive account@zygibo

If you have any questions or concerns feel free to discuss it with us on our discord channel.

Don't forget to follow us busy.orgHive account@busy.org and use our platform https://busy.org if you like our work! You can help us too by voting for our witness here: @busy.witness

Thanks for reading!

Greg from the busy.orgHive account@busy.org team

Leave Increasing SteemConnect security to:

Written by

CTO of utopian.io

Read more #utopian-io posts

Best Posts From Grégory

We have not curated any of gregory.latinier's posts yet. But you can encourage our curation team to review posts by visiting them regularly and by referring other readers. Because we give priority to frequently read content.

More Posts From Grégory