You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
During the call to remote server, authentication should be checked before the server component is created.
Currently, there is a way to execute server component constructor without authentication.
Component constructor can potentially do something sensitive or time-consuming.
I consider it as a security breach.
Describe the bug
During the call to remote server, authentication should be checked before the server component is created.
Currently, there is a way to execute server component constructor without authentication.
Component constructor can potentially do something sensitive or time-consuming.
I consider it as a security breach.
To Reproduce
Expected behavior
Server shouldn't try to create the requested component if authentication is required but not performed.
Additional notes
I'm going to create a pull request demonstrating this issue.
The text was updated successfully, but these errors were encountered: