sveltejs / sveltejs/kit

Remote function module level handlers / module info in server `handle`

Open
#14,528 4 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
20.8k
Forks
2.3k
Avg merge
1d 16h
Merged PRs (30d)
156

Description

Describe the problem

In a recent video, @dummdidumm showed various ways of securing remote functions. These approaches work if applied consistently, but they present a large surface area for mistakes.

When it comes to security, you often want to just reject everything unless explicitly allowed. Mistakes in this area are also far less obvious than anything concerning the page contents. If developers spend the vast majority of the time in a logged-in state, unsecured functions can go unnoticed.

Describe the proposed solution

There could be a handle hook within remote modules which would allow something like securing all remote functions in the module simultaneously.

So even if more functions are added to the module later, as long as the check has been added once, it will automatically apply to any new functions. Of course this is sadly not refactoring-proof.

Alternatively or in addition to that, the regular server handle hook could be used for even stronger default security if more information about the remote functions were available. Currently there is isRemoteRequest but the module of the function is not accessible, only maybe the function name via the generated path in the request.url. The source module path could be useful here for separating functions by area and security requirements.

Alternatives considered

There might be workarounds via additional tooling, e.g. special linter rules that do not allow usage of the non-wrapped remote function constructors. This very much feels like an ugly and complicated workaround, though.

Importance

would make my life easier

Additional Information

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the server handle hook and the remote-function handling described in the issue, including how isRemoteRequest and request.url currently expose information. Compare the proposed module-level handler with making module information available to server handle. Done means the desired security checks can distinguish remote modules and apply consistently to their functions.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.