Explore page: stop sending requests to remote HTTP servers

[lidel]

this is remaining part of regression initially identified in #2250

Bug

Explore page triggers block and delegated routing request to remote HTTP servers, including ones outside of control of IPFS project.

This is bad because it does not leverage local gateway, wastes bandwidth, and leaks IPs and CIDs to third party servers, which is extra bad in private cluster contexts.

Expected behavior

Only the local Kubo RPC and Gateway should be used when IPLD Explorer is used in ipfs-webui.

• There should not be any delegated /routing/v1 calls (local gateway will take care of routing, no need for doing it in JS over the internet)
• The block requests ?format=raw should only go to localhost gateway (like we do for file previews)

[lidel]

@SgtPooki found this after testing latest main branch with #2250 merged, preferably we would fix this and then tag a release to close the privacy leak for private swarm users.

(fine to pick it up after you are back from JS week, we just want to include it in Kubo 0.31 ipfs/kubo#10499)

[SgtPooki]

@lidel explorer components should only be calling remote gateways if it's enabled: https://github.com/ipfs/ipld-explorer-components/blob/cad6b454ec83940dea86ee1bfb20c415ce9efd18/src/lib/init-helia.ts#L20-L40

I think we can just add a localStorage.setItem('explore.ipld.gatewayEnabled', false) in ipfs-webui to disable this behavior for webui

[lidel]

@SgtPooki tried that, but then nothing works, just infinite spinner (for blocks that were not cached).

feels like there needs to be another setting which only uses specific gateway (webui would pass localhost one) and does not use delegated routing?

[SgtPooki]

@lidel if you set the following localStorage config, does it fetch from the local gateway??

localStorage.setItem('kuboGateway', JSON.stringify({ port: '8080', trustlessBlockBrokerConfig: { init: { allowLocal: true, allowInsecure: true }}}))

[lidel]

@SgtPooki yep, seems to do the trick, but it works only if page is reloaded to apply new helia setting (so i guess we need to set this before helia init):

[SgtPooki]

great thanks. I wanted to make sure it worked for you. That means we won't need ipld-explorer-component changes, just default localStorage changes for folks. PR incoming