javascript - Meteor methods on server -

when write meteor methods collections put them in shared directory can simulated on client fast speeds. secure? should put methods in server directory , if kind of methods?

this not way meteor supposed work general case. supposed implement of collection methods (update, insert, remove) client side only, , check updates rights server side.

if have collection posts, not make meteor.call('addnewpost', newpost). , posts.insert(...) in addnewpost meteor method server side. classic way rest api ; meteor :)

you go client side directly posts.insert(...). displayed client side right away , try update base server side.

then server side, have set extensive permissions :

posts.allow({      'insert': function(userid, doc) {         // check if user exists         // if has right insert         // if tries insert ok         // ...     },      'update': function(userid, docs, fields, modifier) {         // same, width fields, doc, user...     },      'remove': function(userid, docs) {         // same again     }  }); 

you can allow() or deny()on can on collection. may seem weird real basis of latency compensation. may hudge security breach if not know how set permission need be. if know how that, there absolutely not security issue.

(my advice deny specific elements want allow)

so :

1. the user updates database client side client side method : mycollection.update()
2. he sees results
3. meteor magic send server
4. the server check if allowed
5. if yes, write in base , send other subscribers
6. if not, send request revert change client side