If I have attachToTangle enabled in my iri.ini config file, then can people send transactions to my server and my server will do proof of work for them?
This seems like I could be taken advantage of.
How do I allow only myself to do attachToTangle and no one from the abyss of the internet?
The API call “attachToTangle” (and others) are DDOS risks and could result in a lot of resources being tied-up if people try to abuse them.
If you are local to your own node, (ie on the same network ;localhost;) then you don't need to enable this in the API for outside connections.
Just make sure to specify the flag in remoteLimitAPI (check that name in the -help).