Sails: Blueprints should be disabled in production by default

[Sytten]

I just took over a quite recent sails codebase done a "professional" firm and I recently discovered that blueprints were enabled in production. This gave access to the whole database without any authentication. My belief is that you should provide a framework that is secure out of the box and it's not helping users to enable blueprints in production by default.

[sailsbot]

@Sytten Thanks for posting! We'll take a look as soon as possible.

In the mean time, there are a few ways you can help speed things along:

• look for a workaround. _(Even if it's just temporary, sharing your solution can save someone else a lot of time and effort.)_
• tell us why this issue is important to you and your team. What are you trying to accomplish? _(Submissions with a little bit of human context tend to be easier to understand and faster to resolve.)_
• make sure you've provided clear instructions on how to reproduce the bug from a clean install.
• double-check that you've provided all of the requested version and dependency information. _(Some of this info might seem irrelevant at first, like which database adapter you're using, but we ask that you include it anyway. Oftentimes an issue is caused by a confluence of unexpected factors, and it can save everybody a ton of time to know all the details up front.)_
• read the code of conduct.
• if appropriate, ask your business to sponsor your issue. _(Open source is our passion, and our core maintainers volunteer many of their nights and weekends working on Sails. But you only get so many nights and weekends in life, and stuff gets done a lot faster when you can work on it during normal daylight hours.)_
• let us know if you are using a 3rd party plugin; whether that's a database adapter, a non-standard view engine, or any other dependency maintained by someone other than our core team. _(Besides the name of the 3rd party package, it helps to include the exact version you're using. If you're unsure, check out this list of all the core packages we maintain.)_
  

  ---

Please remember: never post in a public forum if you believe you've found a genuine security vulnerability. Instead, disclose it responsibly.

For help with questions about Sails, click here.

[georgeben]

I would love to work on this. What do you think? @johnabrams7 @madisonhicks

[whichking]

Thanks so much for pointing this out, @Sytten! We completely agree. Updating this in Sails core means changing the implicit default behavior of Sails, though, which constitutes a breaking change. A better option might be to change the default settings in sails-generate, which would only affect newly generated apps, and would therefore not be a breaking change.

We appreciate your enthusiasm for this project, @georgeben, and we welcome your collaboration! If you're still up for it, here's the general order of what needs to be done:

1. Before making any changes to the code, PRs should be made to update sails-docs to reflect the proposed behavior. This means going into the docs, finding any places where the default settings for blueprints are mentioned, then updating them to reflect the proposed behavior.
2. Once the docs are updated, you’ll want to update sails-generate such that Sails core’s default implicit behavior is overridden, then PR the change.

If you do submit PRs that address this issue, whether to sails-docs or sails-generate, linking to them in this issue thread would help us a lot.

Thanks again!

[Sytten]

I agree with the proposed solution, I would even go a bit further and add a clear warning in the documentation about this and mention it in bold in the changelog.