Pass RPC authentication through an older Web3 provider

The earlier Web3 1.7.4 note placed HTTP or WebSocket provider configuration below a Truffle wallet provider. The transport authenticates RPC access; the wallet provider handles transaction signing. These are separate responsibilities.

- For Http: 
yarn add web3-providers-http

- For Ws:
yarn add web3-providers-ws

Transport options

// ====
// Http
// ====

const Web3HttpProvider = require('web3-providers-http');

const options = {
    keepAlive: true,
    withCredentials: false,
    timeout: 20000, // ms
    headers: [
        {
            name: 'Access-Control-Allow-Origin',
            value: '*'
        },
        {
            ...
        }
    ],
    agent: {
        http: http.Agent(...),
        baseUrl: ''
    }
};

const provider = new Web3HttpProvider('http://localhost:8545', options);

// ==========
// Websockets
// ==========

const Web3WsProvider = require('web3-providers-ws');

const options = {
    timeout: 30000, // ms

    // Useful for credentialed urls, e.g: ws://username:password@localhost:8546
    headers: {
      authorization: 'Basic username:password'
    },

    clientConfig: {
      // Useful if requests are large
      maxReceivedFrameSize: 100000000,   // bytes - default: 1MiB
      maxReceivedMessageSize: 100000000, // bytes - default: 8MiB

      // Useful to keep a connection alive
      keepalive: true,
      keepaliveInterval: 60000 // ms
    },

    // Enable auto reconnection
    reconnect: {
        auto: true,
        delay: 5000, // ms
        maxAttempts: 5,
        onTimeout: false
    }
};

const ws = new Web3WsProvider('ws://localhost:8546', options);

This block combines separate HTTP and WebSocket sketches. It repeats the options declaration and contains ... notation, so it is not a standalone executable module. Access-Control-Allow-Origin is a server response header, not a client-side way to grant cross-origin access. The displayed raw Basic username:password text is also explanatory notation, not the correctly encoded header value.

The historical Truffle configuration

const HDWalletProvider = require('@truffle/hdwallet-provider');
const Web3HttpProvider = require('web3-providers-http');


module.exports = {
  networks: {

    rinkeby: {
      provider: () => new HDWalletProvider(MNEMONIC, `wss://rinkeby.infura.io/ws/v3/${INFURA_API_KEY}`),
      network_id: 4,
      skipDryRun: true,
      networkCheckTimeout: 90000,
      timeoutBlocks: 200,
      // gas: 4698712,
      // gasPrice: 1000000022,
    },

    rinkebyAuth: {
      provider: () =>
        new HDWalletProvider({
          privateKeys: [MNEMONIC],
          provider: new Web3HttpProvider(`https://rinkeby.infura.io/v3/${INFURA_API_KEY}`, {
            headers: [
              {
                name: 'Authorization',
                value: process.env.AUTH_VALUE,
              },
            ],
          }),
        }),
      network_id: 4,
      skipDryRun: true,
      networkCheckTimeout: 90000,
      timeoutBlocks: 200,
    },

  }
}

A credential-like literal in the old source has been replaced with an environment-supplied value. That environment field must hold the complete intended Authorization value. No credential was decoded, tested, or reused.

The source passes a variable named MNEMONIC inside privateKeys; those input forms are not interchangeable. The placeholder and old Rinkeby network entries are preserved to expose the source’s assumptions, not offered as a current network configuration. Reconnect, timeout, and frame-size settings also require an application-specific resource policy.

See the authentication boundary note for the distinction between browser tokens, server secrets, and signing keys. No RPC call, transaction signature, or provider installation was performed here.

← Back to the garden