Search code examples
htmlpathmeteoraccountsiron-router

Page can be viewed by typing in the URL?

On my meteor app I have a login system that sends you to the /dashboard path if you log in or sign up successfully. However, right now it is possible to get to the /dashboard path just by typing in localhost:3000/dashboard. How can I prevent this?

Solution

  • In addition to filtering the route with router hooks or custom actions, you may ensure that the template itself is displayed only to privileged users:

    <template name="secret">
  {{#if admin}}
    ...
  {{/if}}
</template>

Handlebars.registerHelper('admin', function(options) {
  if(Meteor.user() && Meteor.user().admin) return options.fn(this);
  return options.inverse(this);
});

    If you want to show a template to all registered users, you may use {{#if currentUser}} instead, in which case you don't need to register an additional helper.