UserItems.AwardUserItem cannot be blocked for clients

petri.liuska

Hi, I've been experimenting with brain cloud and noticed that I can call UserItems.AwardUserItem as a client and can't find a way to block it. "Cloud Code - API Blocking" does not list it under the UserItems service. This seems rather strange as now a hacked client could just award an unlimited amount of items. Have I misunderstood something or is this a bug?
I've noticed that this kind of blocking can be done for Virtual Currencies though. I believe in never trusting the client and would like to be able to strictly enforce that.

petri.liuska

This will probably do what I'm after: https://help.getbraincloud.com/en/articles/1852058-is-there-a-way-to-prevent-a-client-apps-from-making-certain-api-calls
I'm still wondering if there's a reason why AwardUserItem is not blockable via API Blocking?

JasonL

Thank you for bringing this to our attention. We will proceed to include this API in the list.

Paul Winterhalder

Update - we have patched this issue in our Public BaaS.

The API call is now blockable via API Blocking - but it's also disabled by default now (via the core API itself). There's a new compatibility flag (that is by default enabled for all existing apps) that preserves the old functionality.

Paul.