Comparing user-input data against private data

ashley.welsh49 · 2024-10-03T20:17:36.654Z

Hi, I have a problem that I’m hoping someone can help with. There are other similar posts but I can’t find anything that directly addresses my challenge.

My situation is this: I have an app that allows a user to input a guess, and I need to compare that to an answer in my database that I don’t want to make visible in the browser console.

Right now, I’m storing the user’s guess in the database and then I have a workflow step that compares the user’s input in the field to the answer in the database. The problem is that the answer is being displayed in the browser console, so people can see it when they shouldn’t be able to.

I’ve tried modifying the permissions on the answer data, but when I make it private and not searchable it still shows up in the console.

This is the configuration:

image1398×612 53.2 KB

This is the console:

image852×674 62.3 KB

What can I do?

Thanks!

nico.dicagno · 2024-10-03T20:51:22.192Z

For these types of checks where you don’t want to expose the answer on the browser console the best approach is to actually create privacy rules that stops the user from seeing that data, and then create a backend workflow that bypasses privacy rules where you can run the search and then return a boolean stating whether it was the correct answer or not, or any extra data you may need but you don’t want to expose on the client.

This will ensure that the sensitive data effectively never leaves the server, it’s not accessible to the user if they know how to query it, but the info you need is returned correctly.

This is a very common flow, the most common one being vouchers and promocodes - you don’t want the user to be able to view any promocodes, but you need them to be able to check for their existence and return the data related to the checked promocode.

In bubble, calling your own backedn workflows is a bit tedious, but this topic might be useful:

How To Return Data From Backend API Workflows (no manual API connector) Tips

TLDR: calling backend workflow from API connector is unreasonably tedious app connector auto-sets up and syncs fields result/returned data from backend workflow can be used in following front-end steps Returning data from backend workflow in front-end without manually setting up API connector calls I have a lot of feelings today, as I’ve learned something that would’ve saved me hours of time had I known earlier, and it feels like something that only a handful of people know about (based on th…

nico.dicagno · 2024-10-03T22:38:32.170Z

ashley.welsh49:

I’ve tried modifying the permissions on the answer data, but when I make it private and not searchable it still shows up in the console.

Hadn’t read this part of the problem - can you share the settings you have set for the last Privacy Rule block (ie the Everyone else… block)

ashley.welsh49 · 2024-10-03T23:08:58.889Z

I was logged in as a Free member and was able to see the data from the Solution field in the console.

image1912×1130 205 KB

nico.dicagno · 2024-10-03T23:12:59.022Z

Is the ‘admin only’ rule the only rule you have applied?
Are you on the same version/branch on the editor and run-mode? (ie live vs dev vs other branch)

ashley.welsh49 · 2024-10-03T23:24:19.976Z

Yeah, admin is the only rule and I’m in the Main env

nico.dicagno · 2024-10-03T23:37:41.730Z

Do you tend to rename fields?
Bubble has an issue that it doesn’t actually rename the underlying fieldNames when you rename the bubble display names.

I can see that there are only exposing 4 fields, and there are only 4 fields exposed on the browser. You can see that they each have a slightly different name ( ’ ’ → ‘_’ aside)
Is it possible that the fields you are seeing are the ones that are actually exposed?
Using the debug tool’s inspect mode, check what the display name of the data being loaded are

How is this even Possible? - Option value in logs, doesn't exist in app Bugs

I reported a bug to support on March 27 about an issue with backend workflows not setting the correct option value. In the logs I could see the option that was set, in the database, I can see the same as what is in the logs, but in the workflow action is set to a single value (ie: not dynamic) as this is a status…in the WF action is set to be pending, but in the logs it showed as completed. Bubble support was quick to respond and on March 30th confirmed that they do see the issue, but instead o…