Location of Iron Router Code

Question

I want to verify that I am placing my Iron Router code in the correct location. Right now I have it stored in lib/router.js, which means the code is shared on the client and server. Is that correct?

Also, some of my routes require admin status, such as:

Router.route('/manage', function () {
    if ($.inArray('admin', Meteor.user().roles) > -1) {
        this.render('manage');
    } else {
        this.render('403_forbidden');
    }
});

Is that code safe in its current location? I am also interested in knowing how I can test these kinds of security holes so that I don't have to ask in the future.

Thanks

Answer 1

As to location of router.js ...

Yes, you want it to be available on both the client and server. So putting inside the /lib directory is fine. Really, you can put it anywhere other the the /client or /server directories.

FWIW, in most projects I've looked at, router.js is stored in the top-level project directory. Possibly this is to avoid load order issues (i.e. if the router has some dependencies on files in /lib, /client, or /server, which will generally be loaded before top-level files), or possibly its because everyone I've looked at is working off the same boilerplate code. Check out the Meteor official docs if you want to know more about load order.

As for your admin question, that route should be OK. You can test it by opening up a client side console like firebug and trying something like :

Meteor.users.update(Meteor.userId(), {$set: {roles: ['admin']}});

I believe users can only update fields in the Meteor.users.profile, so this should fail. If it doesn't, you can just add the following deny rule (in client + server);

Meteor.users.deny({
  update: function() {
    return true;
  }
});