Any good way to check duplicate username on form submit?

[maitridan]

I have a user profile form, and on submit, it needs to check whether the new username in the form already exists with another user. And if it does exist already, show an error message on the client. i do have a way to do this, through data subscription and querying, but it seems very clumsy since it’s asynchronous. Does anyone know the best way to do this? Thanks in advance!

[maitridan]

I just found a way, but not sure whether it’s the best:

On the server side, make a method that finds a user by calling:

Meteor.methods({
  "userbyUsername": function(username){
      return Accounts.findUserByUsername(username);
   }
})

Then on the client side, do Meteor.call of that method. Now, if i go this route, is there a good way to make the Meteor.call… synchronous? (i’m using Meteor 1.4 with React)

[efrancis]

this means anyone can call Meteor.call('userbyUsername') through their browser console, and retrieve the full user document for any user, including their emails and any other profile or personal data. that’s a MASSIVE security issue

[maitridan]

You’re right! I didn’t realize. Thank you!

I guess the server method should return something else other than the full user data.

[efrancis]

yeah I would make it just return true/false

Meteor.methods({
  "userExists": function(username){
      return !!Accounts.findUserByUsername(username);   // casts to a boolean, "true" if exists, "false" otherwise
   }
})

you’ll want to rate limit that too, using something like the DDPRateLimiter, because otherwise someone could make a script that just keeps hitting that with every possible combination of characters, and they could find every existing username in your database

[maitridan]

DDPRateLimiter

Sounds very interesting!

Yes, i Made the method return true/false by comparing the find result with an additional parameter (userId) passed in for the method, since the current user should be excluded. i’ll try DDPRateLimiter. Thank you so much!