Hello,
currently I am creating a meteor app with 3 user roles (candidate/company/admin). These roles are attached to user entry when users creates an account on the system
Candidate can only access candidate pages, company can only access company pages and admin can access everything.
In my current build I am allowing/denying access to pages by adding things like:
if(Meteor.user() == null) {
Materialize.toast('Please login', 3000);
FlowRouter.go('/')
} else {
if (Meteor.user()['profile']['type'] != 2) {
Materialize.toast('You cannot access this page', 3000);
FlowRouter.go('/');
}
}
(oh yeah - I am using Flow-router for routing)
The more I read about Meteor security - the more I hear “never trust the client” things.
Question - is this a safe way to allow/deny access to parts of a Meteor app? Are there better alternatives for this?
P.S. I was thinking about sending userId to the server side and writing some decision login there - but the userId would have to come from the client (via Meteor.userId()?) - meaning that it can potentially be forged.