Comments (4)
Is that common code? This package API is available only on the server, and in general it's not a good idea to have your rules defined in code that is sent to the client since your rule might be wrong and anyone would be able to see that and exploit it more easily.
from meteor-security.
Oh, I see. This obviously makes a lot of sense, but the reason I put this code into common code is because the Discover Meteor book actually has all of their Deny and Allow code in the lib/collections
folder, so common code (for the record, I thought this was strange, but chalked it up to them wanting to use latency compensation). I simply followed the same pattern. Perhaps add in the ReadMe that this security package should be defined on the server?
from meteor-security.
I agree it's confusing, mostly because Meteor documents allow/deny as server-only but yet defines them in common code. For now we'll keep this pkg server-only, but if the Meteor docs ever change to indicate they officially support calling allow/deny on the client, then we can probably do the same. Just because I'm opinionated does not mean this pkg has to be.
In the meantime, I clarified the readme.
from meteor-security.
I also find it confusing. In fact I think I had just assumed allow and deny ran on the client tooβ¦
from meteor-security.
Related Issues (20)
- vsivsi:file-collection compatibility HOT 1
- TypeError: Object #<SecurityRuleConstructor> has no method 'ifHasRole' HOT 3
- How to express this security setup? HOT 5
- 1.3.0 not working with Meteor.roles HOT 4
- connection inside defined method HOT 1
- Defined method's doc is not fetched when using Security.can() HOT 2
- question: upsert
- Conflict with matb33:meteor-collection-hooks prevents startup HOT 2
- Can Read? HOT 4
- Way to go about updating from a collection hook HOT 2
- Question - Best way to access user profile in defineMethod HOT 1
- Create exception for collection-hooks package HOT 1
- Document is inserted then removed HOT 1
- Transition to npm? HOT 3
- .allowInClientCode() unexpectedly applies to all rules of that type HOT 1
- setOnInsert not allowed in a restricted collection HOT 1
- Don't work, I base on `[email protected] + Vue` HOT 1
- Could I use "Rate Limiting" with this? HOT 2
- Security issue with update and remove HOT 2
- Client-side Security....check() always returns true HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from meteor-security.