Question

If you turn autopublish off. How tamper proof and secure is the client side Meteor.users collection?

My experiments have shown it to be tamper proof. I have tried client side scripting on the console to insert, update and remove and get 403 errors.

For example you can try this, use one of your users collection ids and then $push something or $set something. You can also try remove and inserts too.

Meteor.users.update({_id: "72277b27-3a53-4aa3-82b7-fb096060a8dc"}, {$set: {foo:'bar'}})

or

Meteor.users.insert({this:'that'})

or

Meteor.users.remove({_id: "72277b27-3a53-4aa3-82b7-fb096060a8dc"})

and you should get a 403 on all of these.

But how tamper proof and secure is it?

Thanks
Steeve

Answer 1

Seeing as Meteor.users is fresh on the auth branch and not part of an official release, I’d consider it bleeding-edge with the possibility of bugs (which you should report if you find, by the way).

That being said, it appears to be designed with the goal of being tamper-proof and secure, given that it’s part of an authentication system.