12

The first insert works fine, but the second Gives "Insert Failed: 403 -- Access denied" in the console. Auto subscribe is enabled, and I am on the auth branch. How do I set up my code so that I have a server MongoDB that clients can write to?

People = new Meteor.Collection('people'); 

if (Meteor.is_server) {
People.insert({name: 'Bob'});
}
if (Meteor.is_client) {
People.insert({name: 'Bob'});
}
3
  • Yes, I am on the auth branch.
    – Alex
    Commented Oct 8, 2012 at 19:56
  • Ok, so I'm guessing it is because I have no insert validator...
    – Alex
    Commented Oct 8, 2012 at 20:01
  • Exactly, you need to call People.allow. Commented Oct 8, 2012 at 21:54

4 Answers 4

21

Because you are working with auth, you must allow or deny clients trying to do inserts, updates, removes, and fetches. To fix this specific issue you must add Collection.allow() to let the client's insert work.

if(Meteor.is_server) {

  People.allow({
    'insert': function (userId,doc) {
      /* user and doc checks ,
      return true to allow insert */
      return true; 
    }
  });

}
2
  • 5
    As a side note for the inexperienced reader: the code snippet in this answer may not be safe for your case. This snippet allows any client to update the related collection (i.e., People). If you are using Meteor's new Accounts API (docs.meteor.com/#accounts_api), you need to return a check on the logged user (e.g., return userId && doc.owner === userId, where owner is a fetched attribute of your collection). See the Example section in docs.meteor.com/#allow
    – user237076
    Commented Nov 6, 2012 at 20:22
  • I had to put it outside the is_server namespace for this to work.
    – radtek
    Commented Oct 18, 2014 at 23:55
8

Use method allow() in the Collection People. This method assign access CRUD.

function adminUser(userId) {
  var adminUser = Meteor.users.findOne({username:"admin"});
  return (userId && adminUser && userId === adminUser._id);
}
Lugares.allow({
  insert: function(userId, lugar){
    return adminUser(userId);
  },
  update: function(userId, lugares, fields, modifier){
    return adminUser(userId);
  },
  remove: function (userId, docs){
    return adminUser(userId);
  }
});
3
  • 1
    Why 'Lugares'? Maybe it should be 'People'?
    – Artemix
    Commented Jul 16, 2013 at 12:34
  • 1
    This answer is not really related to the question is it? Commented Jul 16, 2013 at 15:05
  • Why did this get downvoted? It shows the three allow functions you need to add handlers for. Also this code needs to run on the client AND the server, so this is more appropriate. (Client side it pre-calculates the results of calling this and skips a server round trip.
    – MrMowgli
    Commented Mar 5, 2014 at 19:27
3

I've encountered this error after I removed insecure package from my project.

meteor remove insecure

Following fixed my problem.

Posts = new Meteor.Collection('posts');

Posts.allow({
  insert: function(userId, doc) {
    // only allow posting if you are logged in
    return !! userId;
  }
});
1
2

If you have only testing project such as simple-todos tutorial, you can solve it with adding the insecure package

meteor add insecure

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.