FEAT: Prevent self question #91
Conversation
|
Someone is attempting to deploy a commit to a Personal Account owned by @mazipan on Vercel. @mazipan first needs to authorize it. |
yogiprsetya
force-pushed
the
feat/no-self-question
branch
from
7254b8c
to
5ed8cb6
Compare
| @@ -80,6 +84,15 @@ export function QuestionForm({ owner }: { owner: UserProfile }) { | |||
| if (process.env.NODE_ENV === 'development') { | |||
| await sendQuestion(owner?.slug || '', data.q, 'development') | |||
| } else { | |||
| if (isLogin && user?.email?.includes(owner.slug)) { | |||
There was a problem hiding this comment.
Hmmm, actually user can update the slug after first login.
So detecting by matching with the email is misslead.
There was a problem hiding this comment.
The correct one is by matching the uid.
But for the public page, I already strip the uid from the response for security purposes 😂
There was a problem hiding this comment.
This feature seems quite hard to solve for now.
There was a problem hiding this comment.
One approach that I can think is:
- Passing authorization token, if user logged in
- In the server API:
- Get session by the token
- Get uid from the session we get (if exist)
- if the uid is the same with the owner of the question, you can reject it.
Seems complicated and adding at least 1 API call to the session DB
There was a problem hiding this comment.
hi sir, how about comparing slug from browser URL and slug from account info?, we can do this on file src/modules/PublicQuestionPage/QuestionForm.tsx ?
when owner of the page click Kirim Pertanyaan button, just show a dialog to tell that owner of the page cannot ask to themself
There was a problem hiding this comment.
Oh yes, it's possible I guess 🎉
Just can we also adding a way to submit question for our self?
In some cases, let say for testing, maybe we need that 🙈
For initial, can we enable the feature on the process.env.NODE_ENV === 'production' only? Or adding new env var NEXT_PUBLIC_ENABLE_SELF_SUBMISSSION
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Prevent self question
Description
We don't know what the free tier will be like in the future, it's better if we make DB writes more efficient.