8. Security with the Allow and Deny Rules | Building Single-page Web Apps with Meteor

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Building Single-page Web Apps with Meteor

By : Fabian Vogelsteller

4.5 (8)

Building Single-page Web Apps with Meteor

4.5 (8)

By: Fabian Vogelsteller

Overview of this book

If you are a web developer with basic knowledge of JavaScript and want to take on Web 2.0, build real-time applications, or simply want to write a complete application using only JavaScript and HTML/CSS, this is the book for you. This book is based on Meteor 1.0.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Started with Meteor

1. Getting Started with Meteor

The full-stack framework of Meteor

Meteor's requirements

Installing Meteor

Creating our first app

Adding basic packages

Variable scopes

Meteor's folder conventions and loading order

Meteor's command-line tool

Summary

2. Building HTML Templates

2. Building HTML Templates

Writing templates in Meteor

Building the basic templates

Adding templates and partials

Displaying data with template helpers

Setting the data context for a template

"this" in template helpers and template callbacks

Adding events

Block helpers

Listing posts

Spacebars syntax

Summary

3. Storing Data and Handling Collections

3. Storing Data and Handling Collections

Meteor and databases

Setting up a collection

Adding post examples

Querying a collection

Updating a collection

Database everywhere

Differences between client and server collections

Summary

4. Controlling the Data Flow

4. Controlling the Data Flow

Syncing data – the current Web versus the new Web

Removing the autopublish package

Publishing data

Publishing only parts of data

Publishing specific fields

Lazy loading posts

Switching subscriptions

Some notes on data publishing

Summary

5. Making Our App Versatile with Routing

5. Making Our App Versatile with Routing

Adding the iron:router package

Setting up the router

Switching to a layout template

Adding another route

Moving the posts subscription to the Home route

Setting up the post route

Changing the website's title

Summary

6. Keeping States with Sessions

6. Keeping States with Sessions

Meteor's session object

Using sessions in template helpers

Rerunning functions reactively

Using autorun in a template

The reactive session object

Summary

7. Users and Permissions

7. Users and Permissions

Meteor's accounts packages

Adding the accounts packages

Adding admin functionality to our templates

Creating the template to edit posts

Creating the admin user

Creating routes for the admin

Summary

8. Security with the Allow and Deny Rules

8. Security with the Allow and Deny Rules

Adding a function to generate slugs

Creating a new post

Editing posts

Restricting database updates

Adding a deny rule

Adding posts using a method call

Calling the method

Summary

9. Advanced Reactivity

9. Advanced Reactivity

Reactive programming

Building a simple reactive object

Creating an advanced timer object

Reactive computations

Summary

10. Deploying Our App

10. Deploying Our App

Deploying on meteor.com

Deploying on other servers

Outlook

Summary

11. Building Our Own Package

11. Building Our Own Package

The structure of a package

Creating our own package

Releasing our package to the public

Summary

12. Testing in Meteor

12. Testing in Meteor

Types of tests

Testing packages

Testing our meteor app

Acceptance tests

Summary

A. Appendix

A. Appendix

List of Meteor's command-line tool commands

The iron:router hooks

Index

Index

Customer Reviews

4.5 (8)

5 star

62.5%

4 star

25%

3 star

12.5%

2 star

0

1 star

0

Adding a deny rule

To improve security, we can fix the owner of the post and the time when it was created. We can prevent changes to the owner and the timeCreated and slug fields by adding an additional deny rule to our Posts collection, as follows:

if(Meteor.isServer) {

  // Allow rules

  Posts.deny({
    update: function (userId, docs, fields, modifier) {
      // Can't change owners, timeCreated and slug
      return _.contains(fields, 'owner') || _.contains(fields, 'timeCreated') || _.contains(fields, 'slug');
    }
  });
}

This rule will simply check whether the fields argument contains one of the restricted fields. If it does, we deny the update to this post. So, even if our previous allow rules have passed, our deny rule ensures that the document doesn't change.

We can try the deny rule by going to our browser's console, and when we are at a post page, typing the following commands:

Posts.update(Posts.findOne()._id, {$set: {'slug':'test'}});

This should give you an error stating update...

Search

Your notes and bookmarks