Seguranca no meteor

[andredornas]

Ler a documentacao do meteor e descobrir como ele trata seguranca

[andredornas]

https://guide.meteor.com/security.html

[andredornas]

Security checklist

This is a collection of points to check about your app that might catch common errors. However, it’s not an exhaustive list yet—if we missed something, please let us know or file a pull request!

• Make sure your app doesn’t have the insecure or autopublish packages.
• Validate all Method and publication arguments, and include the audit-argument-checks to check this automatically.
• Deny writes to the profile field on user documents.
• Use Methods instead of client-side insert/update/remove and allow/deny.
• Use specific selectors and filter fields in publications.
• Don’t use raw HTML inclusion in Blaze unless you really know what you are doing.
• Make sure secret API keys and passwords aren’t in your source code.
• Secure the data, not the UI - redirecting away from a client-side route does nothing for security, it’s just a nice UX feature.
• Don’t ever trust user IDs passed from the client. Use this.userId inside Methods and publications.
• Set up browser policy, but know that not all browsers support it so it just provides an extra layer of security to users with modern browsers.