origin can be used to trigger a call from the client gateway to anywhere

[rmeissner]

• Check if this is a security issue
  • Could you create a loop where the origin points to the safe transaction itself and therefore results in the interface calling itself?
• In some cases this caused a blocking call (as we did not have a connection timeout) which at some point blocked the whole service.
  • Switch to non blocking version of reqwest

Solutions:

• Disallow localhost as source
• Disallow static IPs as source (aka require a dns entry)
• Only allow http protcols

[jpalvarezl]

For non blocking reqwest migration, it could be worth checking out this: rwf2/Rocket#1065

[rmeissner]

We do not need to wait for this, as according to the rocket docs they already support async io (see https://rocket.rs/master/guide/overview/#futures-and-async). This still would be a major change that would affect the whole app.