News for hackers. Stuff that matters.

A comment on Meteor hits 1.0. Parent comment

Re:Meteor hits 1.0 by dandv on Wednesday October 29, 2014 @03:29AM (#8525971)
In the same vein, there's no way to shield the user from accessing the parameters of a REST request. Which incidentally is easier to replay outside the browser than a Meteor.call().
[ Parent | on HN ]
Re:Meteor hits 1.0 by denom on Wednesday October 29, 2014 @09:21AM (#8526984)
After doing some poking it looks like you can access `this.userId` in the server-side publish and Meteor.methods functions. That's enough to prevent a lot of client-side tampering
[ Parent | on HN ]