Meteor Iron-router server-side only route how to get the current user?

Question

For a server-only route, How can I get the current user.

Please note this is a route that looks like:

    this.route('report_access', {
      path: '/report/:humanId?/:reportKey',
      where: 'server',
      action: ....
   });

This is not in a publish or method call so Meteor.user() / Meteor.userId() fails.

I looked in the route.params and there is no userid set.

Answer 1

This works for me in 0.8:

if(this.request.cookies.meteor_login_token) u = Meteor.users.findOne({"services.resume.loginTokens.hashedToken": Accounts._hashLoginToken(this.request.cookies.meteor_login_token)});

I'm basically hashing the raw Meteor login token with the Accounts._hashLoginToken() function which allows for matching with the hashed token stored in the DB.

Answer 2

You can't really do this on the server side without setting cookies on the client side when you log in.

Meteor stores the user's authentication token in localStorage which is not available at the HTTP header stage, only later after the page is loaded on client side javascript.

If you want to access the value in the headers in the manner like you are doing you would have to set a cookie when the user logs in with the user's token.

The users token is at localstorage/Meteor.loginToken & user Id at Meteor.userId().

Then check this value with the request header and find the token amongst the user's stored tokens in the users collection in mongodb at services.resume.loginToken.

There is a considerable security caveat to doing this because your loginToken is more exposed and could be used to get access to the account.

How does Meteor work with logins

Meteor establishes a DDP connection over websockets. When the web page has loaded with a previous 'saved' log in state, these loginTokens are read using javascript with the localstorage api. DDP is a communications layer over websockets or sockjs Meteor uses to communicate with the server.

The login occurs via the DDP protocol, after the javascript has loaded. This is the primary reason you can't do this directly with a server side route because you would not have access to DDP this way since Meteor's libraries are not available and no DDP connection is established at this point when the http request is sent.

Meteor's call & subscribe methods use this login to authenticate to publish methods on the server which all occurs on the DDP wire.

This answer should go into the specifics of how a login takes place: Authenticating with Meteor via DDP (and SRP?)