CODEWITHSUNDEEP
securitymethodsmeteor
Tarlen
Tarlen

Reputation: 3797

Meteor.methods and security

say I have a Meteor.method addCredits(user, amount), that add the specified amount of credits to the user account. Then what is stopping a potential hacker from just scanning the source code, find the method, and call it from the client console?

Upvotes: 2

Views: 79

Answers (2)

Peppe L-G
Peppe L-G

Reputation: 8345

Nothing is stopping a hacker from doing that. In the method, you must check that the user has done something that gives him the right to call the method.

Upvotes: 0

user728291
user728291

Reputation: 4138

Making sure users only execute methods they are allowed to is done by checking this.userId within the method on the server. That id gets set when the user logs in and is available in all methods. If no user is logged in this.userId equals null inside a method.

Management of user account and associating the userId with a connection is handled by using the accounts system, such as using the packages 'accounts-base' and 'accounts-password'. The accounts system is documented here.

this.userId is documented here.

An example of how to restrict method execution is here.

Upvotes: 2

Related Questions