ACL on client or server side

Moralis General
#1

hi, my code

var user = Moralis.User.current();
user.setACL(new Moralis.ACL(user));

if set ACLs in client js code , I think this is not security, how to I can security my code, thank for help

#2

You normally set permissions in Cloud Code on the server not in the client
For example when a new user signs up - you set up ACL in afterSave trigger

Read docs on Security and Triggers

https://docs.moralis.io/moralis-server/cloud-code/triggers
https://docs.moralis.io/moralis-server/database/security

What you can do on client-side is to allow the users to change whether other users should be able to see some of their private data

#3

ok, thank for help, i will read it

#4

Hi, the Trigger afterSave for user in moralis it not run, is there any other way?
thanks

#5

try beforeSave instead

#6

Screenshot_8
Screenshot_8977×210 4.03 KB

Now with beforeSave, i cant get any params or object user in current, why?

my code

Moralis.Cloud.beforeSave(Moralis.User, async function(request) {
  logger.info('before save user')
  var user = Moralis.User.current();
  logger.info(request)
  logger.info(user)
});
#7

What you see if you try logger.info(JSON.stringify(request));?