UserItems.AwardUserItem cannot be blocked for clients
Hi, I've been experimenting with brain cloud and noticed that I can call UserItems.AwardUserItem as a client and can't find a way to block it. "Cloud Code - API Blocking" does not list it under the UserItems service. This seems rather strange as now a hacked client could just award an unlimited amount of items. Have I misunderstood something or is this a bug?
I've noticed that this kind of blocking can be done for Virtual Currencies though. I believe in never trusting the client and would like to be able to strictly enforce that.
This will probably do what I'm after: https://help.getbraincloud.com/en/articles/1852058-is-there-a-way-to-prevent-a-client-apps-from-making-certain-api-calls
I'm still wondering if there's a reason why AwardUserItem is not blockable via API Blocking?
Update - we have patched this issue in our Public BaaS.
The API call is now blockable via API Blocking - but it's also disabled by default now (via the core API itself). There's a new compatibility flag (that is by default enabled for all existing apps) that preserves the old functionality.