Knack login doesnt protect custom javascript elements

Help Center Get Answers
1

I’ve just realised injecting for example a custom table or any element using javascript and protecting it using a login doesnt work.

I have a login protected page and in javascript I listen to the page load and inject some custom table in it. When I refresh the page, it sure asks for the login and I cant see the custom table but when I get to the page through normal navigation, the custom table gets exposed, with the login form appearing below it

This means anything injected with javascript cant be protected by login? How’s everyone dealing with this

image
image532×596 20.2 KB

2

Hi @Henry3

JavaScript will run from any page even a login screen. You shouldn’t be able to get the data into the table from an API call unless the user is logged in or you are exposing your API key and doing object based API calls (Never put your API key in your JavaScript).

You can check if the page has a login element before running your code to make sure it doesn’t run on a login screen. Or you can check if the user is logged in before running your code.

Craig

1 Like
3

Hi @CSWinnall thanks for the tip, I’ll do that and check for login in the scene object. Key is not exposed data is just coming from external source

4

Hi Henry

This is what we use:

if ( !$('.kn-login')[0]) {
                //Your code here
}

Or

if (Knack.getUserAttributes() !== 'No user found'){
         //Your code here
}

Craig

1 Like
5

Cool thanks!