Meteor.uuid is deprecated and untrusted on the client side about mantra-sample-blog-app HOT 5 OPEN

I do not understand why the id is passed anyway.

Doesn't Collection.insert generate a id on its own if not passed? And this should even work if happens both in a client-stub and the server-method?

from mantra-sample-blog-app.

The id of two sides should be the same. If you use the id generated by insert. Probably it's not same as client stub.

from mantra-sample-blog-app.

The id is passed in for latency compensation.

The solution is pretty simple, just need to create a custom check function for uuid, to verify it is correct. This would prevent passing in invalid uuids, and make the latency compensation still work.

something like this:

check(_id, Uuid);

from mantra-sample-blog-app.

FYI, the Meteor.uuid() call should most likely be replaced by Random.id() https://github.com/meteor/meteor/tree/master/packages/random

from mantra-sample-blog-app.

Submitted a pr for this fix.

A uuid validator is pretty much a check for a string that is 17 characters -- there really isn't a necessity to check for anything further, as it's all randomized anyways. You can see how this is created with a custom matcher at https://github.com/markoshust/mantra-sample-blog-app/blob/ef35a2fac1eba766eab08959b315c5f4636b38e7/lib/match.js

Then, just import that matcher and run check against it, as so https://github.com/markoshust/mantra-sample-blog-app/blob/0ae9cc607642ca99e76f6f0956a0f07dc60bf800/server/publications/posts.js

I'm not 100% sure this is really needed on the client... most likely just needed on server, but updated client scripts to keep things consistent.

I also updated Meteor.uuid() to Random.id().

#115

from mantra-sample-blog-app.