Harden MM pool flow and frontend guards

lib/apiInterfaces.js

@@ -9,19 +9,20 @@
 var http = require('http');
 var https = require('https');
 
-function jsonHttpRequest (host, port, data, callback, path) {
+function jsonHttpRequest (host, port, data, callback, path, extraHeaders) {
 	path = path || '/json_rpc';
 	callback = callback || function () {};
+	extraHeaders = extraHeaders || {};
 	var options = {
 		hostname: host,
 		port: port,
 		path: path,
 		method: data ? 'POST' : 'GET',
-		headers: {
+		headers: Object.assign({
 			'Content-Length': data.length,
 			'Content-Type': 'application/json',
 			'Accept': 'application/json'
-		}
+		}, extraHeaders)
 	};
 	var req = (port === 443 ? https : http)
 		.request(options, function (res) {
@@ -51,7 +52,7 @@ function jsonHttpRequest (host, port, data, callback, path) {
 /**
  * Send RPC request
  **/
-function rpc (host, port, method, params, callback) {
+function rpc (host, port, method, params, callback, extraHeaders) {
 	var data = JSON.stringify({
 		id: "0",
 		jsonrpc: "2.0",
@@ -64,7 +65,7 @@ function rpc (host, port, method, params, callback) {
 			return;
 		}
 		callback(replyJson.error, replyJson.result);
-	});
+	}, '/json_rpc', extraHeaders);
 }
 
 /**
@@ -99,11 +100,11 @@ module.exports = function (daemonConfig, walletConfig, poolApiConfig) {
 		batchRpcDaemon: function (batchArray, callback) {
 			batchRpc(daemonConfig.host, daemonConfig.port, batchArray, callback);
 		},
-		rpcDaemon: function (method, params, callback, serverConfig) {
+		rpcDaemon: function (method, params, callback, serverConfig, extraHeaders) {
 			if (serverConfig) {
-				rpc(serverConfig.host, serverConfig.port, method, params, callback);
+				rpc(serverConfig.host, serverConfig.port, method, params, callback, extraHeaders);
 			} else {
-				rpc(daemonConfig.host, daemonConfig.port, method, params, callback);
+				rpc(daemonConfig.host, daemonConfig.port, method, params, callback, extraHeaders);
 			}
 		},
 		rpcWallet: function (method, params, callback) {