{"action":"created","issue":{"url":"https://api.github.com/repos/meteor/guide/issues/36","labels_url":"https://api.github.com/repos/meteor/guide/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/meteor/guide/issues/36/comments","events_url":"https://api.github.com/repos/meteor/guide/issues/36/events","html_url":"https://github.com/meteor/guide/issues/36","id":112071719,"number":36,"title":"Security","user":{"login":"tmeasday","id":132554,"avatar_url":"https://avatars.githubusercontent.com/u/132554?v=3","gravatar_id":"","url":"https://api.github.com/users/tmeasday","html_url":"https://github.com/tmeasday","followers_url":"https://api.github.com/users/tmeasday/followers","following_url":"https://api.github.com/users/tmeasday/following{/other_user}","gists_url":"https://api.github.com/users/tmeasday/gists{/gist_id}","starred_url":"https://api.github.com/users/tmeasday/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmeasday/subscriptions","organizations_url":"https://api.github.com/users/tmeasday/orgs","repos_url":"https://api.github.com/users/tmeasday/repos","events_url":"https://api.github.com/users/tmeasday/events{/privacy}","received_events_url":"https://api.github.com/users/tmeasday/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/meteor/guide/labels/article","name":"article","color":"bfd4f2"}],"state":"open","locked":false,"assignee":{"login":"stubailo","id":448783,"avatar_url":"https://avatars.githubusercontent.com/u/448783?v=3","gravatar_id":"","url":"https://api.github.com/users/stubailo","html_url":"https://github.com/stubailo","followers_url":"https://api.github.com/users/stubailo/followers","following_url":"https://api.github.com/users/stubailo/following{/other_user}","gists_url":"https://api.github.com/users/stubailo/gists{/gist_id}","starred_url":"https://api.github.com/users/stubailo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stubailo/subscriptions","organizations_url":"https://api.github.com/users/stubailo/orgs","repos_url":"https://api.github.com/users/stubailo/repos","events_url":"https://api.github.com/users/stubailo/events{/privacy}","received_events_url":"https://api.github.com/users/stubailo/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-10-19T04:55:49Z","updated_at":"2015-10-19T20:21:31Z","closed_at":null,"body":null},"comment":{"url":"https://api.github.com/repos/meteor/guide/issues/comments/149334926","html_url":"https://github.com/meteor/guide/issues/36#issuecomment-149334926","issue_url":"https://api.github.com/repos/meteor/guide/issues/36","id":149334926,"user":{"login":"stubailo","id":448783,"avatar_url":"https://avatars.githubusercontent.com/u/448783?v=3","gravatar_id":"","url":"https://api.github.com/users/stubailo","html_url":"https://github.com/stubailo","followers_url":"https://api.github.com/users/stubailo/followers","following_url":"https://api.github.com/users/stubailo/following{/other_user}","gists_url":"https://api.github.com/users/stubailo/gists{/gist_id}","starred_url":"https://api.github.com/users/stubailo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stubailo/subscriptions","organizations_url":"https://api.github.com/users/stubailo/orgs","repos_url":"https://api.github.com/users/stubailo/repos","events_url":"https://api.github.com/users/stubailo/events{/privacy}","received_events_url":"https://api.github.com/users/stubailo/received_events","type":"User","site_admin":false},"created_at":"2015-10-19T20:21:31Z","updated_at":"2015-10-19T20:21:31Z","body":"Securing a Meteor app can actually be quite simple if you understand the possible attack surface. Part of good security practice is to minimize that surface and make sure every input is what your expect it to be.\r\n\r\n#### No allow/deny\r\n\r\nThis guide will focus on methods only, rather than doing mutations from the client and attempting to validate them with rules. This limits the possible attack surface area of the app, and will tie together well with what we want to do for forms: #29 \r\n\r\nFun article: https://www.discovermeteor.com/blog/allow-deny-challenge-results/\r\n\r\n#### alanning:roles\r\n\r\nWe'll probably recommend this for managing user roles, unless something else comes along.\r\n\r\nhttps://github.com/alanning/meteor-roles\r\n\r\nI don't think we can use ongoworks:security because it seems fairly tailored to the allow/deny model of things.\r\n\r\n#### Managing API keys\r\n\r\nProbably Meteor.settings is the correct way to do this. We should document some principled ways of managing settings between development/test/staging/production environments. Perhaps this is just recommended naming for the files.\r\n\r\nHow does this interact with environment variables? Perhaps the Meteor tool should let you pass env vars in Meteor settings?\r\n\r\n#### Common mistakes\r\n\r\n- insecure/autopublish (aaaaaahhhhhhh I hate insecure personally.)\r\n- Not filtering fields in publications\r\n- Publishing user documents with sensitive data, like hashes or keys\r\n- Not doing security in data fetched inside methods - don't let method side effects expose data\r\n- Use specific selectors\r\n- Securing the route and not the data being sent\r\n- Don't ever ever trust the client - note that all the code you write can be called trivially from the browser console\r\n- Always check types everywhere with simple-schema\r\n- Don't use user profile, ever\r\n- Be careful about `{{{ .. }}}` when printing HTML to the page. don't use it unless you really absolutely have to\r\n- **Anything else?** I tried to scour online sources for this stuff, the above is all I found."}}