search

cd88 / taker

goal: capture user events (js/mongo) and review with time-scrubbing video playback
0 stars 0 forks source link

Security? #8

Open nw opened 6 years ago

nw commented 6 years ago

https://github.com/celloworld/giver/blob/master/app.js#L63

Pretty sweet I can just save anything into your db. Including all kinds of stuff that can wreck havoc on your server.

nw commented 6 years ago

Are you sure userID is what you think it is? --- It is the same for everyone.

nw commented 6 years ago

Your error handler stack trace can leak too much information. This should only run in development mode. Server should have ENV switches for control. While you're at it make the port configurable via ENV too.

nw commented 6 years ago

consider making the mongo collection configurable too.