{"action":"created","issue":{"url":"https://api.github.com/repos/meteor/guide/issues/36","labels_url":"https://api.github.com/repos/meteor/guide/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/meteor/guide/issues/36/comments","events_url":"https://api.github.com/repos/meteor/guide/issues/36/events","html_url":"https://github.com/meteor/guide/issues/36","id":112071719,"number":36,"title":"Security","user":{"login":"tmeasday","id":132554,"avatar_url":"https://avatars.githubusercontent.com/u/132554?v=3","gravatar_id":"","url":"https://api.github.com/users/tmeasday","html_url":"https://github.com/tmeasday","followers_url":"https://api.github.com/users/tmeasday/followers","following_url":"https://api.github.com/users/tmeasday/following{/other_user}","gists_url":"https://api.github.com/users/tmeasday/gists{/gist_id}","starred_url":"https://api.github.com/users/tmeasday/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tmeasday/subscriptions","organizations_url":"https://api.github.com/users/tmeasday/orgs","repos_url":"https://api.github.com/users/tmeasday/repos","events_url":"https://api.github.com/users/tmeasday/events{/privacy}","received_events_url":"https://api.github.com/users/tmeasday/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/meteor/guide/labels/article","name":"article","color":"bfd4f2"},{"url":"https://api.github.com/repos/meteor/guide/labels/ideation","name":"ideation","color":"9999FF"}],"state":"open","locked":false,"assignee":{"login":"stubailo","id":448783,"avatar_url":"https://avatars.githubusercontent.com/u/448783?v=3","gravatar_id":"","url":"https://api.github.com/users/stubailo","html_url":"https://github.com/stubailo","followers_url":"https://api.github.com/users/stubailo/followers","following_url":"https://api.github.com/users/stubailo/following{/other_user}","gists_url":"https://api.github.com/users/stubailo/gists{/gist_id}","starred_url":"https://api.github.com/users/stubailo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stubailo/subscriptions","organizations_url":"https://api.github.com/users/stubailo/orgs","repos_url":"https://api.github.com/users/stubailo/repos","events_url":"https://api.github.com/users/stubailo/events{/privacy}","received_events_url":"https://api.github.com/users/stubailo/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2015-10-19T04:55:49Z","updated_at":"2015-10-22T15:35:16Z","closed_at":null,"body":null},"comment":{"url":"https://api.github.com/repos/meteor/guide/issues/comments/150264664","html_url":"https://github.com/meteor/guide/issues/36#issuecomment-150264664","issue_url":"https://api.github.com/repos/meteor/guide/issues/36","id":150264664,"user":{"login":"pcorey","id":3384035,"avatar_url":"https://avatars.githubusercontent.com/u/3384035?v=3","gravatar_id":"","url":"https://api.github.com/users/pcorey","html_url":"https://github.com/pcorey","followers_url":"https://api.github.com/users/pcorey/followers","following_url":"https://api.github.com/users/pcorey/following{/other_user}","gists_url":"https://api.github.com/users/pcorey/gists{/gist_id}","starred_url":"https://api.github.com/users/pcorey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcorey/subscriptions","organizations_url":"https://api.github.com/users/pcorey/orgs","repos_url":"https://api.github.com/users/pcorey/repos","events_url":"https://api.github.com/users/pcorey/events{/privacy}","received_events_url":"https://api.github.com/users/pcorey/received_events","type":"User","site_admin":false},"created_at":"2015-10-22T15:35:16Z","updated_at":"2015-10-22T15:35:16Z","body":"@stubailo This is an awesome project!\r\n\r\nA few thoughts on security things.\r\n\r\n***\r\n\r\nCollection validators (allow/deny) can be a little harder to think about, but I don't know if I'd advocate completely avoiding them. If you [whitelist the modifiers](http://blog.east5th.co/2015/06/15/allow-and-deny-challenge-check-yourself/) you accept within an allow/deny, and assuming you understand the 1-pass rules of allow & deny, you should be pretty well off. Accepting random modifier object into methods can be [more dangerous](http://blog.east5th.co/2015/10/19/rename-your-way-to-admin-permissions/) than using collection validators because `$rename` is allowed in that context.\r\n\r\nThe bottom line is that ___a lot of apps___ use allow/deny rules because they fall in line with Meteor's much-hyped \"DB everywhere\" way of doing things. Not acknowledging that as an attack vector may lead to misunderstandings.\r\n\r\n***\r\n\r\nNot using profile ___ever___ is a bit much. Just be aware that profile is writable by clients by default. That default can be changed if needed.\r\n\r\n***\r\n\r\nOne note about browser-policy is that CSP [isn't supported on all browsers that Meteor supports](http://caniuse.com/#feat=contentsecuritypolicy). This might lead people to thinking it's a silver-bullet for XSS across the board, when it's actually not. IMO, you should only rely on browser-policy as a last line of defense, not your only means of protection.\r\n\r\n***\r\n\r\nOne more small thing is to always use `this.userId` on the server, rather than trusting a user provided userId or user object. That can lead to [all kinds of issues](http://blog.east5th.co/2015/05/05/meteor-security-in-the-wild/).\r\n\r\n***\r\n\r\nJosh's checklist is a good summary of all of this stuff.\r\n\r\nAt the end of the day, I wouldn't advocate avoiding certain pieces of the stack (validators, profile, triple brace template tags, etc...), I would just try to emphasize what they do and what their dangers are. The only way to really build a secure app is to understand all of this stuff, not to avoid it.\r\n\r\nThanks for all the hard work you're doing with this project!"}}