How to disable collection inserts from Meteor.connection


I have defined collection in my app:

import { Mongo } from 'meteor/mongo';
export const SomeItems = new Mongo.Collection('someItems');

And I import it into “server/main.js”.

The issue I have is, that when I build my app locally, I still can insert stuff into db from Chrome console, like so:
“Meteor.connection._stores.someItems._getCollection().insert({test: 123})”

I know, there is a way, to disable such db population, but cant seem to find it.

For all the help, thanks in advance! :slight_smile:

Meteor doc, chapter Security, section Avoid allow/deny

1 Like

Check if you have the insecure package installed. It’s included by default with meteor create for fast app scaffolding.

Removing that package should be enough to prevent inserts via console

1 Like

Thanks for answers! :slight_smile: Insecure package was the culprit.

1 Like