Ensure that users log in first in a Meteor application.
This works by delaying treatment of incoming DDP messages, until
.setUserId()
is
called.
Instructions
If you would like to enforce that your application not work at all for not logged-in users, proceed as follows:
meteor add epfl:loginfirst
- (optional) Whitelist any Meteor methods and subscriptions that should not be delayed, e.g.
- ???
- Profit!
(Step 3 may involve, you know, putting some work into your project)
How It Works
The server rejects any and all method calls and subscription requests (unless whitelisted), and rejects them promptly (i.e. no server-side DDP message reordering takes place), unless and until the user is logged in.
As far as subscriptions are concerned, the Meteor client-side runtime
does subscribe to a handful of them automagically as soon as the app
starts, and some of your app's widgets might do same. All of these
subscriptions will get a nosub
DDP response before login completes —
But that is harmless, because client-side Meteor already knows to
retry all subscriptions whenever the login
method succeeds¹. Also,
the meteor.loginServiceConfiguration
subscription is whitelisted by
default, which is enough to let your app display a multi-provider
login widget (with server-side list of providers) if it was programmed
to do so prior to enabling epfl:loginfirst
.
If you need to call a DDP method before login
(which should be
fairly unusual), make sure to whitelist it (see above).
¹ Covered by a test in meteor/packages/accounts-base/accounts_reconnect_tests.js