How to disable collection inserts from Meteor.connection

help
1

Hello!

I have defined collection in my app:
“imports/api/someItems/collections.js”

import { Mongo } from 'meteor/mongo';
 
export const SomeItems = new Mongo.Collection('someItems');

And I import it into “server/main.js”.

The issue I have is, that when I build my app locally, I still can insert stuff into db from Chrome console, like so:
“Meteor.connection._stores.someItems._getCollection().insert({test: 123})”

I know, there is a way, to disable such db population, but cant seem to find it.

For all the help, thanks in advance! :slight_smile:

2

Meteor doc, chapter Security, section Avoid allow/deny

1 Like
3

Check if you have the insecure package installed. It’s included by default with meteor create for fast app scaffolding.

Removing that package should be enough to prevent inserts via console

1 Like
4

Thanks for answers! :slight_smile: Insecure package was the culprit.

1 Like