News for hackers. Stuff that matters.

A comment on Meteor and Qt. Parent comment

Re:Meteor and Qt by tracker1 on Tuesday December 23, 2014 @04:22PM (#8790303)
How does your example prevent someone with access to your meteor server from bypassing your custom permissions? My understanding is the code in question runs on the client.
[ Parent | on HN ]
Re:Meteor and Qt by kazagistar on Tuesday December 23, 2014 @08:39PM (#8791150)
I think the code runs in both places. In the client, it describes the messages it will send, and in the server, it describes the messages to expect. So the server still verifies that the database requests are only permitted ones.
[ Parent | on HN ]
Re:Meteor and Qt by achipa on Wednesday December 24, 2014 @04:15AM (#8792211)
There is no difference compared to a web page - the permissions are still handled server-side, I'm just relaying the events via DDP.
[ Parent | on HN ]