meteor-security

Meteor security

Meteor's security model is opinionated: the server holds authority, the client cannot be trusted, and the only places that filter data before it reaches users are methods (write paths) and publications (read paths).

Decision flow

1. Audit every method: does it check() every argument and guard on this.userId or Meteor.userId() when authentication matters?
2. Audit every publication: does it filter by this.userId (when user-specific) and project columns with fields?
3. Add audit-argument-checks in dev to catch missing check().
4. Add browser-policy and configure CSP.
5. Add DDPRateLimiter rules for sensitive methods (login, password reset, resource creation).
6. If the app uses OAuth, set oauthSecretKey to encrypt provider secrets at rest.
7. Remove allow / deny rules. They are legacy and easy to misuse; use methods instead.

Method guard checklist

import { Meteor } from "meteor/meteor";
import { check, Match } from "meteor/check";

Meteor.methods({
  async updateProfile(payload) {
    check(payload, { displayName: String, bio: Match.Optional(String) });
    if (!this.userId) {
      throw new Meteor.Error("not-authorized");
    }
    await Meteor.users.updateAsync(this.userId, { $set: { profile: payload } });
  },
  async updateAddress(payload) {
    check(payload, String);
    if (!Meteor.userId()) {
      throw new Meteor.Error("not-authorized");
    }
    await Meteor.users.updateAsync(Meteor.userId(), { $set: { address: payload } });
  },
});

Reject any method that does not match: check on every argument, userId gate when needed, Meteor.Error(code, reason) for failures, *Async Mongo on the server.

Publication guard checklist

Meteor.publish("items.mine", function () {
  if (!this.userId) return this.ready();
  return Items.find(
    { ownerId: this.userId },
    { fields: { title: 1, qty: 1 }, limit: 200 },
  );
});

Reject any publication that returns an unbounded cursor, omits the field projection, or skips a userId filter on user-specific data.