After creation a new user, auth and adding some data. In second browser one can easily delete the data... What am I doing wrong?
First browser (Firefox private window):
<!doctype html>
<meta charset="utf-8">
<body>
<script src="https://cdn.jsdelivr.net/npm/gun/gun.js"></script>
<script src="https://cdn.jsdelivr.net/npm/gun/sea.js"></script>
<script>
localStorage.clear()
var gun = Gun({ peers: ['http://localhost:8765/gun'] });
var user = gun.user();
user.create('u1','p1',()=>{
user.auth('u1','p1', ()=>{
user.set({some:'thing'}).on(() => {})
})
})
</script>
</body>
</html>
Second (Chrome incognito):
<!doctype html>
<meta charset="utf-8">
<body>
<script src="https://cdn.jsdelivr.net/npm/gun/gun.js"></script>
<script src="https://cdn.jsdelivr.net/npm/gun/sea.js"></script>
<script>
localStorage.clear()
var gun = Gun({ peers: ['http://localhost:8765/gun'] });
gun.on()
</script>
</body>
</html>
Peer on port 8765 started with http.js from examples.
After this in the second browser in the storage localStorage.getItem('gun/') I get nodes prefixed with undefined like: undefined~@u1 and undefinedSoulfofsomething I also can delete content with gun.get('Soulofsomething').put({some:null}).
If this is normal behavior, how to protect data from attack? Only option is bulletcatcher?
EDIT:
@brezyl thank you for bringing up this issue, if you are seeing
undefined~@...that definitely looks like a bug and that the data is not saving to where it should be saving (the protected user space).I'll check into this urgently, I'll also send a notice out to the community if anybody is experiencing the same.
Until then, yes, please use a different version of GUN & SEA, or assume
undefinedis indication of erros/bugs going on resulting in security loss.Updates:
@brezyl Update: So far I'm noticing that
.put(seems to be OK, primitive value.set(seem OK, but.set(objectNOT OK OR SAFE. Investigating further.@brezyl update: I have found 2 ways to fix it, and will be doing both to add extra failsafes. Hopefully will be publishing ASAP (tests/review may take a while).