moleculerjs/moleculer-db

[SECURITY] automatically created molecular-db actions can't be authenticated

Haiz14 opened this issue · 3 comments

Haiz14 commented 
/**
* The "moleculer-db" mixin registers the following actions:
*  - list
*  - find
* - count
*  - create
*  - insert
*  - update
*  - remove
*/

These methods that molecular db registers automatically can't be authorised, and anyone can list all the data in the database.

Haiz14 commented

There should atleast be a config option to disable them.

Haiz14 commented

Thanks a lot, i should learn how to search issues before posting them. Sorry then.