CODEWITHSUNDEEP
meteor
Wes
Wes

Reputation: 844

How do you securely log out and clear all subscriptions?

I implemented my own login system, because I'm using a third party web service to authenticate users against an enterprise authentication system. As such, I built a form that calls a server method to make the web service call to the auth system, and if the credentials are valid, it sets a session variable with the user's id. This is how I change the template to show the main screen of the application and not the login screen. Works fine. And the logout button then just sets that userid session variable to false, effectively hiding the main application screen and showing the login form again.

<body>
  {{#if loggedInUser}}
  {{> navbar}}
  {{> mainScreen}}
  {{else}}
  {{> customLogin}}
  {{/if}}
</body>

  Template.navbar.helpers({
    loggedInUser: function () {
      return Session.get('userName');
    }
  }); 

  'click #logoutButton': function () {
      Session.set("userName", false);
}

What I have discovered though, is that the local minimongo collections/subscriptions are still in the browser, and accessible in the console, after the user logs out.

I did some searching but didn't find concrete solutions as to how to properly clear out (or stop?) these subscriptions on the client. In fact, the top 3 hits on a search for "meteor publish subscribe " don't mention stopping or security upon logout.

One suggestion on SO was to save the subscription handle ... but I'm calling subscribe multiple times, so it seems I would have to store up an array depending on how many different subscribes the user triggered during their use of the application, and then go through them calling "stop" on each handle when logging out??

I'm hoping there's a simple way to stop all subscriptions... seems like a logical thing to do for security when a user clicks a logout button.

Thanks!

Upvotes: 4

Views: 1949

Answers (1)

loken
loken

Reputation: 305

Could you not use .stop() function on the collection?

var subscription = Meteor.subscribe("info");

//on logout

subscription.stop();

According to the docs:

stop() Cancel the subscription. This will typically result in the server directing the client to remove the subscription's data from the client's cache.

Updated: Maybe check out this package: Subs Manager. It appears they may be able to do what you want, specifically from their readme:

Clear Subscriptions

In somecases, we need to clear the all the subscriptions we cache. So, this is how we can do it.

var subs = new SubsManager();

// later in some other place
subs.clear();

Upvotes: 3

Related Questions