transfer api on ethereum web3 contract, How it is not possible changing “from” parameter on main net?

Question

I'm new in Dapp. and researching how to make dapp. and I found some codes like this. transferring tokens between wallets

Token.transfer(accounts[1], 10, {from:accounts[2]}).then(function(result){
      console.log(result)
    })

This will send 10 tokens from account[2] to account[1]

I understand this is development mode and it can handles all accounts.

But, I don't know How it is not possible in production? I can't find any thing about this..

Does any user can call this api changing from address? If not, How it is not?

I think there should be some preventing code user cannot change from value.

Answer 1

The test RPC network, all account could be unlocked. All unlocked accounts can be handled without signed transaction.

you can unlock/lock account using command

web3.personal.unlockAccount(address);
web3.personal.lockAccount(address);

If you lock account, you can't use 'transfer' function directly without signed transaction.

Refer: How to make signed transaction

• All account will be locked as a default in eth main network.

Answer 2

For transfer purposes in erc20 tokens, there are 2 methods, Transfer and TransferFrom .

If you are using transfer method you have to sign transaction with FromAccount private key.

If you are using TransferFrom you have to set Allowance for FromAccount to ToAccount in previous transaction (signed by FromAccount private key). You can't transfer tokens from FromAccount without transactions signed with FromAccount private key even in develop network.