Eclair v0.14.4 Blocks Browser Requests to Lightning Node API

Eclair’s v0.14.4 update blocks browser requests from reaching its Lightning node API, closing a path that could let a webpage trigger authenticated commands such as channel changes or payments.

Released Oct. 15, the update returns HTTP 403 for any API request carrying an Origin header before the request reaches an endpoint. The API can read node state, open or close payment channels and send or receive payments.

The risk involved HTTP Basic authentication: a browser could attach cached credentials to a form submitted from another website. Although the page could not read the response, the requested command could still run.

The restriction also blocks same-origin browser interfaces. Dashboards that previously connected directly to Eclair now need a back end, while command-line tools such as curl and eclair-cli remain usable.

The header check is a defense against browser-based cross-site requests, not an authentication mechanism. Because nonbrowser clients can omit the header, operators should keep the API bound to loopback.

Operators can stop Eclair, install the compatible update and restart without closing open channels. The release follows recent Eclair fixes to limit excessive Bitcoin mining fees.