Authentication of User before displaying data from database

Ask the community
,
1

I am working on a site for Financial company that will allow their customers to pull their account via a search and then give them options to pay

Using the tutorials I have a page that has the input field, button, and table that filters and shows the row.
code:


import wixData from 'wix-data';

$w.onReady(function () {
	//TODO: write your page related code here...

});

export function button1_click(event, $w) {

wixData.query('ConsumerTable') 
  .contains('cellPhoneNumber', $w('#input1').value)
  .find()  
  .then(res => {   
    $w('#table1').rows = res.items;
    $w('#table1').show();
   });
}

Here’s the flow of things to help better explain what i need help with

1920×1440 436 KB

So I need help after a user searches for their account info on the table, the user needs to verify their identity by inputting their Date of Birth or Social Security Number then redirect them to a page that will display the info and a pay button to pay with options via stripe.

because of the sensitivity of the data, I would like to make it so that an email or text with a code or link is sent to the address or phone number in the table of that user that will redirect them to the pay/account page or if there is another way to authenticate I am all ears.

Right now I have the table hidden on the page with the search and it will show and info after the onClick function, but it will show the whole table if you search it blank.
I’m assuming there is a way to connect the data without the table (linked to the database dataset) on the page, so if someone can help guide me to having the search and table tied together but secured from each other so that the database info can’t be compromised and that only that users information can be accessed.

Any help or alternate methods or anything to go about doing this is greatly welcome and I’m open to any idea, comments, and anything everyone has.

Thanks everyone!

2

Hi Kenneth!

A few suggestion as for how to solve the issues you’re facing:

  1. Separate your platform into few pages.
    Make a page for the search, a members-only page to verify the user’s info, a page to display the
    account’s info. Why? Backend code!

  2. Backend code.
    For maximum security write the verification code in your backend service.
    Use the query in the backend and send to it the SSN from the search page in the frontend.
    Once a result is found, take the ‘_ID’ (usually is set as invisible field in the collection) of the item and
    return it to the verification page. Use the returned ID to present the current info and verify it through a
    triggered email or SMS (send a code to the user and ask him to insert it on the verification page).

    All the verifications and checks of the database should be done in the backend for maximum security
    and protection of the data.

  3. As for presenting the data,
    Pushing the results of the query into a table works totally fine but you need to make sure that the results
    you’ve got are valid (res.length > 0 means that there are results for the search). That the searched input
    is not empty (otherwise table.hide( ) ). And that the searched field is a unique one (anyone can search
    and log with any email address and several times with the same one).

Hope it helps.
Best of luck!

Doron. :slight_smile: