Meteor security with methods tutorial not working!


I ran through this page of the text and at the beginning after running meteor remove insecure did notice all of my buttons and inputs stopped working, which is good - I am on track with the tutorial so far.

Then at the end of the page for the tutorial, my buttons and inputs start working again. However, whether I am signed in or not, I am able to check ‘X’ to delete the task or I am able to click ‘check’ to tell the app I completed the task. This can be done by any user!

I do see that the client and database code is now separate. However, I thought the point of this page of the tutorial was to prevent a non-signed-in user or a different user B to prevent from checking or deleting a user A’s tasks! Therefore, if any user can still delete or check the task, have I completed this part of the tutorial correctly?


Actually in the Publish and Subscribe part of the tutorial it shows us how to make public tasks not checkable by anyone…sorry everyone for the alarm.