Yoo! How are you !? I have been doing some work around logical security based on current user information, like ´if this topic.creator.username to be equals to User.current().username´ I allow the user to edit topic or exclude! So, the point is, I need to guarantee some actions based on User sessi…

[画像] feabila: This way, some actions in my system would be enabled just by this change If you change information in your local browser, that does not change anything on the back end. The User is logged in via an authentication token, I believe, so you can’t masquerade as anyone else to the b…

Yoo! Yeah! As you said, the best way so would be always get current user session from back-end server. This way, cache changes from the browser couldn’t affect! Do you know somewhere I can check that logical security is based on user session from backend server, and not from PreloadStore ? Warn m…

I’m no security expert, just an app dev, but all persistent changes can only be made on the server. What happens on the browser in EmberJS is for the user’s convenience and superior usability experience, eg. caching for speed, automagic app-like interface behaviour. It doesn’t change the fact that…

I’m concerned because I’m working in some approaches which such action will be available or not depending on your User, if you are topic creator, if you are post creator, so this way I need to validate based on backend user session. Like this, on post the user can edit it, if you are the post creat…

You should develop all the security measures firstly on the back end. The rails serializers determine what data gets sent. The Guardian protects what actions are allowed. All of this is managed by the Rails Controllers. It doesn’t matter what junk the front end sends or what it requests to retri…

Thank you Robert, I needed this feedback! I will check it for sure! Best Regards,

Yoo Robert! I have been analyzing plugin code and codebase about post controls (actions). To check which I could do the most about security. As analyzed! By front-end there are some steps which make sure if user can edit or not the post, like: 1° step: SiteSetting.post_menu_hidden_items 2° step:…

Well done. Very pleased you kept going and dug further :+1:t2:

現在のユーザーのアクションに対する論理的なセキュリティ

開発

merefield (Robert) 2020 年 11 月 25 日午後 11:28 9

よくやりましたね。諦めずにさらに深く掘り下げてくれて、とても嬉しいです👍🏻

トピック		返信	表示
Logged in as different user real time Product Support	38	826	2025 年 2 月 19 日
How to get the current_user details in Discourse.Dialect.postProcessText for both client and server side? Development	7	1862	2016 年 8 月 17 日
Get logged in user info from another website SSO	11	521	2024 年 2 月 15 日
Is there an endpoint to check if a user is logged in Development	17	5975	2020 年 1 月 21 日
How Discourse implements Auth w/ Ember Development	0	619	2017 年 9 月 5 日

現在のユーザーのアクションに対する論理的なセキュリティ

関連トピック