Authenticate the Zebra RPC port.

[oxarbitrage]

We noted that having the RPC port non authenticated can lead to some problems. We will want to take some action however we are not sure which option will be the best, there are several, for example:

• add basic http auth (username/password)
• add an auth cookie (zcashd do this when no u/p is available)

Opening the discussion to share ideas and more details.

[conradoplg]

This post has some other approaches: https://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/#mitigations

I like "Checking the Host header" for its simplicity, but we need to make sure it's robust enough.

[randomstuff]

For reference, I'd suggest the last solution (using a UNIX/local socket) if possible for mitigation DNS-rebinding/CSRF attacks against system-local services. It makes sure no internet-based connection can directly target it and provides some support for blocking other system users from accessing the service.

[teor2345]

Currently, the RPC port doesn't have access to any secrets, so it is low risk. But it does let users submit transactions (and blocks with the getblocktemplate work).

We might want to document that RPCs are unauthenticated, and say they should be run bound to localhost on a dedicated machine or VM.

[mpguerra]

closing this in favour of #8153