As having said, I could just only use wixData.query to query the collection on front-end, not on backend, when I use this query on backend, there is no result returned. This poses a critical vulnerability that when the query code appears on the client side on javascript file, an attacker could modify the code to query all the collections on the database, for example:
wixData.query(“myCollection”) .find() .then( (results) => { let firstItem = results.items[0]; //see item below } ) .catch( (err) => { let errorMsg = err; } );
if this code appears on the javascript file on front end, a malicious user could change collection named “myCollection” to another collection, or he/she queries the data belonged to another user, etc. He/she forces the client side query the data that he/she wants.
On our website project built on Wix, we avoid using query, insert, etc,… any database-related function on client side to mitigate the risk of being attack, but seems like the wixData.query is not applicable on the back end, so we stuck here. Please inform us that Wix Code Team understands the risk that I have pointed above and give solution to tackle problems. Thanks