How to limit a function call to the UI

Developers Language Support
1

Hello,

I want to limit/control the call of a function only from the embedded interface in the application. Not from Candid UI or dfx with an anonymous call.

I thought about:

  • A shared token, but you need to store that token.
  • OTP but there is also a secret to share and store.
  • A very short-lived code.

Do you have another suggestion or ICP trick that I don’t know ?

2

Hi,
I’m not sure if it answers your question but you can filter the caller based on its key with this api caller in ic_cdk::api - Rust

3

Thanks for the answer @dymayday , but no I don’t think so, because the call is anonymous. My use case is: I have a contact form that before sending the message performs some checks to avoid spam. These checks are done on the client side, I would like to limit the function call to the interface to avoid bypassing the checks with a dfx or candid UI direct call.

4

There is nothing you can do that makes the client trustworthy to execute operations under your control rather than theirs. This is universal among client-server applications; not even web3 can change that.

5

Agree with @AdamS don’t think there is an option.

To kind of solve the feature you are looking for, I added a secret as a constructor parameter of one of the last actor canister I created and then set that parameter as an environment variable of my frontend dapp.

actor class MyCanister(secret: Text) {
    public shared({ caller }) func something(secret: Text, myObject: MyObject) : async () {
        if (not validSecret(secret)) {
            throw Error.reject("Caller does not have the permission.");
        };

        ...
    };

}

It does not prevent anyone to find it, since it gets bundled in the JS code it’s public, but I thought that at least it’s a bit less obvious for those who want to query my canister with dfx.

6

Thank you all for your answers :+1:

7

Perhaps you should get in contact with Rick from DSCVR - @rckprtr . I know they implemented some captcha at some point, and they had to have solved the captcha → canister communication. Maybe they can help?

8

If all you care about is sanitizing ingress messages from someone using DFX, this might help Message inspection | Internet Computer Home

But this doesn’t apply to inter-canister calls

9

@kentosugama
Excellent thank you very much, I had read this material some time ago and had completely forgotten about it. Yes indeed associated with a secret I must be able to achieve my goals.

Thank you