8 ms·
Looks good, and useful to me, nice work. Will you be covering security in any detail? Most people seem to miss this and I'm discouraged to see when I download
by thomc 13y ago
Looks good, and useful to me, nice work.
Will you be covering security in any detail? Most people seem to miss this and I'm discouraged to see when I download the MEAN project this is based on it has serious security flaws.
For example, if you view the articles list at /#!/articles and make a note of any article ID, then visit /article/<article_id> it will return the article author's hashed password, salt and email address in addition to the article content. This also works while logged out. Kinda scary if people are using this as a template for their own apps.
- bemurphy 13y agoYeah that freaked me out too. I'm not super familiar with mongoose either so at the time I couldn't figure out how to leave them out of serialization always. I could do it for one-off calls but there should be a way to generally whitelist I'd think.
- mfrisbie 13y agoThat was one of the first things I noticed when examining the MEAN stack. The final version of the tutorial will take care of this flaw.