Meteor prevent methods from being called from console -
i have meteor game of heads or tails keeps stats of user in profile. stats eg. wins , loses changed using meteor methods incrementwins , incrementloses.
is there way prevent users calling these methods on console?
i didn't find precise answer question i'll add one.
is there way prevent users calling these methods on console?
the short answer no.
as long have meteor
variable available on client, it's not possible restrict user use if browser console. meteor allows client side use meteor.call
function in conditions, therefore if restrict usage somehow, affect whole application, not browser console.
you can, however, make methods more secure. know, can make code run either on client side, server side, or both. if put methods on server side, client side never know what exactly happens methods executed, nor able influence or intercept control anyhow.
on other hand, if put methods in lib/ or both/ folder (or root folder of app), methods run both on client , on server. insecure part of code (like bulk removing collection items or manipulating meteor.users
collection) won't executed on client side. may want put change ui state or show messages, ironically, on browser console. think twice before applying practice.
i think exaggerate meaning of ability run on browser console. first, small group of users (but if do, expect smallest holes in app exploited). second, meteor secured in part, doesn't allow user run insecure code (unless insecure
package added, default create new app). , third, of time, methods executed, data updated reactively, meteor takes care of out of box, don't need worry refreshing ui after app state change, etc.
Comments
Post a Comment