This is a follow-up on #12 which provided a Netlify Functions endpoint as a convenient way for legacy V1 apps to upload Filebase without the heavy changes required to support Atlas SIWE authentication.
Rationale
The Netlify function upload endpoint: offers no authentication, can easily be abused, goes against the intended usage of Netlify functions and is limited to file uploads up to 4 MB due to the underlying AWS Lambda request body size hard limit.
In addition we have observed that AI agents are able to discover the existence of this Netlify upload endpoint, which greatly lowers the barrier for abuses.
The legacy V1 frontends are in a better position now than they were two years ago so it may be possible to migrate entire to Atlas uploads with SIWE authentication. And this Netlify function could be deprecated.
Survey of impacted clients
Frontends
Escrow v1 (new): VITE_IPFS_UPLOAD_URL env var
Dispute Resolver: hardcoded here
Noteworthy
Court v1: there is no IPFS upload at all, since evidence submission is on the arbitrable side or provided by the Resolver.
Escrow v1 (old): retired, will not fix.
⚠️ Update: More usage found
V2 Archive PR: This is a backend CLI usage, in the worst case we enforce symmetric key authentication with the Netlify function to preserve this kind of usage, only if there's not more frontends using it.
Guangmian's Curate Admin aka Glamstation
Guangmian's LGTCR data fetching SDK
Guangmian's Escrow data fetching SDK
This is a follow-up on #12 which provided a Netlify Functions endpoint as a convenient way for legacy V1 apps to upload Filebase without the heavy changes required to support Atlas SIWE authentication.
Rationale
The Netlify function upload endpoint: offers no authentication, can easily be abused, goes against the intended usage of Netlify functions and is limited to file uploads up to 4 MB due to the underlying AWS Lambda request body size hard limit.
In addition we have observed that AI agents are able to discover the existence of this Netlify upload endpoint, which greatly lowers the barrier for abuses.
The legacy V1 frontends are in a better position now than they were two years ago so it may be possible to migrate entire to Atlas uploads with SIWE authentication. And this Netlify function could be deprecated.
Survey of impacted clients
Frontends
Escrow v1 (new):
VITE_IPFS_UPLOAD_URLenv varDispute Resolver: hardcoded here
Noteworthy
Court v1: there is no IPFS upload at all, since evidence submission is on the arbitrable side or provided by the Resolver.
Escrow v1 (old): retired, will not fix.
V2 Archive PR: This is a backend CLI usage, in the worst case we enforce symmetric key authentication with the Netlify function to preserve this kind of usage, only if there's not more frontends using it.
Guangmian's Curate Admin aka Glamstation
Guangmian's LGTCR data fetching SDK
Guangmian's Escrow data fetching SDK