Secure a Server Action
renameNote plays a Server Function: it runs on the "server" and callServer plays the network. Right now it trusts the client completely: it accepts an empty or huge name, and it trusts the ownerId the client sends, so the Simulate an edited request button can rename someone else's note.
Fix only the server function. Get the user from the session (sessions[cookie], return Please sign in. if missing), validate the name (trimmed; empty → Name is required., more than 40 characters → Name is too long.), find the note by id and the session user's id (otherwise return Not found), then save and return Saved.. The UI shows the returned message in #msg and #forged-result.
What Check tests
- An empty name is rejected with
Name is required. - A 41-character name is rejected with
Name is too long. - A valid name is saved:
#titleshowsGroceries - The edited request can't rename another user's note
Stuck? One hint at a time
The solution unlocks after your first Check. Try first: that is where the learning happens.
Your page
Console
Nothing logged yet.