From f9f85c4bba163e3087962b840bf4e0fd5d7dd184 Mon Sep 17 00:00:00 2001
From: renaynay <41963722+renaynay@users.noreply.github.com>
Date: Mon, 30 Mar 2020 18:04:09 +0200
Subject: [PATCH] removed some todos and fixed comment according to martins
 suggestion

---
 cmd/clef/main.go      | 2 +-
 cmd/geth/retesteth.go | 2 +-
 node/rpcstack.go      | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/cmd/clef/main.go b/cmd/clef/main.go
index e5f2f2a0c5..7d17994481 100644
--- a/cmd/clef/main.go
+++ b/cmd/clef/main.go
@@ -543,7 +543,7 @@ func signer(c *cli.Context) error {
 
 		err := node.RegisterApisFromWhitelist(rpcAPI, []string{"account"}, srv, false)
 		if err != nil {
-			utils.Fatalf("Could not register API: %w", err) // TODO should this be a fatal failure?
+			utils.Fatalf("Could not register API: %w", err)
 		}
 
 		handler := node.NewHTTPHandlerStack(srv, cors, vhosts)
diff --git a/cmd/geth/retesteth.go b/cmd/geth/retesteth.go
index 2baca165d0..24ea46110c 100644
--- a/cmd/geth/retesteth.go
+++ b/cmd/geth/retesteth.go
@@ -892,7 +892,7 @@ func retesteth(ctx *cli.Context) error {
 
 	err := node.RegisterApisFromWhitelist(rpcAPI, []string{"test", "eth", "debug", "web3"}, srv, false)
 	if err != nil {
-		utils.Fatalf("Could not register RPC apis: %w", err) // TODO should this be a fatal error?
+		utils.Fatalf("Could not register RPC apis: %w", err)
 	}
 
 	handler := node.NewHTTPHandlerStack(srv, cors, vhosts)
diff --git a/node/rpcstack.go b/node/rpcstack.go
index 2ff65d9989..793061968d 100644
--- a/node/rpcstack.go
+++ b/node/rpcstack.go
@@ -52,9 +52,9 @@ func newCorsHandler(srv http.Handler, allowedOrigins []string) http.Handler {
 }
 
 // virtualHostHandler is a handler which validates the Host-header of incoming requests.
-// The virtualHostHandler can prevent DNS rebinding attacks, which do not utilize CORS-headers,
-// since they do in-domain requests against the RPC api. Instead, we can see on the Host-header
-// which domain was used, and validate that against a whitelist.
+// Using virtual hosts can help prevent DNS rebinding attacks, where a 'random' domain name points to
+// the service ip address (but without CORS headers). By verifying the targeted virtual host, we can
+// ensure that it's a destination that the node operator has defined.
 type virtualHostHandler struct {
 	vhosts map[string]struct{}
 	next   http.Handler