CODEWITHSUNDEEP
javascriptnode.jsmeteordynamicdynamic-import
Márius Rak
Márius Rak

Reputation: 1472

Control of dynamically loaded scripts in Meteor.js

Would there be any mechanism (at least theortical) which would allow to control which scripts are provided to a client? I have splited code into dynamically loadable parts using import('dynamically_loadable_file') but whenever is it called on a client, the file is served. I'd like to perform some security check whether does a user have permission to load the file. I thought of middlewares but those are only for HTTP and executable scripts are served through WebSockets.

Also, if it would be possible I would like to control content of the provided scripts. E.g. I'd like to add or "hide" some functions or variables to the script based on a user loading them. I guess something like dynamic compilation using AST would be required, or maybe there is/would be available something else. I guess that's another level but if there would be some content available on such ideas I'd be thankful.

Maybe it is not possible with meteor at all, so if this is possible wherever in JavaScript (node.js) world, it'd help too.

Thanks for ideas and explanations.

Upvotes: 0

Views: 169

Answers (1)

Jankapunkt
Jankapunkt

Reputation: 8413

Most client-side protection mechanism can be surrounded with enough knowledge and the right tools.

The most viable solution to your problem would be to use a server side rendering (ssr) library for your current front-end engine.

With ssr your would solve to

  • allow to control which scripts are provided to a client?

  • perform some security check whether does a user have permission to load the file

  • scripts are served through WebSockets

  • control content of the provided scripts

  • add or "hide" some functions or variables to the script based on a user loading them

Because all your templates are rendered on the server and only the resulting data is returned to the client.

Some ssr packages for Meteor:

Generic: https://docs.meteor.com/packages/server-render.html

React: https://www.chrisvisser.io/meteor/how-to-set-up-meteor-react-with-ssr (guide with link to a boilerplate repo)

Vue: https://github.com/meteor-vue/vue-meteor/tree/master/packages/vue-ssr

The native Meteor Way

Besides this I would like to emphasize, that you can achieve most data handling through Publications and Methods.

Showing / hiding HTML elements on the client does not add any security if your data and logic are not secured on the server.

If you only publish the right data to the right user (for example using alanning:roles) then it does not matter which scripts you load.

Same goes for Methods: If you are very strict in who (use again alanning:roles) can call a Method then it does not matter, if a user can disable the Router and see all of the "hidden" areas on the client because all invalid actions are rejected server-side.

Upvotes: 1

Related Questions