mongodb - Safe Methods in Meteor -

mongodb - Safe Methods in Meteor -

i'm working on messaging app using meteor. disabled insert/update/remove called client security reasons. way insert messages using methods.

meteor.methods({ sendmessage: function (text) { messages.insert({ userid: meteor.userid(), roomid: rooms.findone()._id, name: meteor.users.find(meteor.userid()).fetch()[0].profile.name , message: text }); } });

this approach asks content of message, there's no way user phone call method using other name or seek send same message other chat rooms.

i'm beginner using meteor wonder, wouldn't real method (not stub) run on server different values userid , roomid? rooms.findone()._id on server random room document on db, userid user.

if case have include parameters on function create much less secure.

i'm not understanding methods here.

you on right track. using rooms.findone() doesn't create sense on server, , frankly isn't on client either (if ever publish more 1 room break). need pass both message , room id method. method should validate insert makes sense. example, user in room. assuming that's tracked in room.members, sendmessage implemented follows:

class="lang-js prettyprint-override">meteor.methods({ sendmessage: function(message, roomid) { check(message, string); check(roomid, string); if (!this.user) throw new meteor.error(401, 'you must logged in.'); if (_.isempty(message)) throw new meteor.error(403, 'message must not empty.'); var room = rooms.findone(roomid); if (!room) throw new meteor.error(404, 'room not found.'); if (!_.contains(room.members, this.userid)) throw new meteor.error(403, 'you not in room.'); var name = meteor.user().profile.name; homecoming messages.insert({ userid: this.userid, roomid: roomid, name: name, message: message }); } });

not of these checks may necessary, illustration should give thought of rich set of validations method can provide.

mongodb methods meteor