UserItems.AwardUserItem cannot be blocked for clients
-
Hi, I've been experimenting with brain cloud and noticed that I can call UserItems.AwardUserItem as a client and can't find a way to block it. "Cloud Code - API Blocking" does not list it under the UserItems service. This seems rather strange as now a hacked client could just award an unlimited amount of items. Have I misunderstood something or is this a bug?
I've noticed that this kind of blocking can be done for Virtual Currencies though. I believe in never trusting the client and would like to be able to strictly enforce that. -
This will probably do what I'm after: https://help.getbraincloud.com/en/articles/1852058-is-there-a-way-to-prevent-a-client-apps-from-making-certain-api-calls
I'm still wondering if there's a reason why AwardUserItem is not blockable via API Blocking? -
Update - we have patched this issue in our Public BaaS.
The API call is now blockable via API Blocking - but it's also disabled by default now (via the core API itself). There's a new compatibility flag (that is by default enabled for all existing apps) that preserves the old functionality.
Paul.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login