State changes from backend custom events leak to the frontend regardless of privacy rules
Did some testing on the new Trigger a backend custom event action. If a synchronous, page-triggered backend custom event writes to a field, the written value comes back in the workflow’s network response (state_changes) in cleartext — even if the field is privacy-hidden. It only sends back the fields that are written to with the written values, it does not appear to leak the entire datatype for the record being edited.
In my testing I was not passing in the datatype that I was changing into the backend workflow event, I was actually perform a search in the backend workflow and then making changes to it. Not sure what happens when you pass in the datatype / record you are updating.
Workaround: Schedule an API Workflow inside the backend event to do writes. It runs detached, so it never hits the frontend response. Keep your checks in the synchronous event, put the sensitive write in the async scheduled WF. So atleast you can still do checks and return custom values e.g. isError from the backend event, you wont know the write was successful but it still may be useful.
The only difference here is that because it’s a backend custom event you expect only the returned value to be returned (and that’s not what happens). But I know Bubble team is aware so they’ll either do that, or document it clearly.
My parameters to a call to a external API won’t show right? Just the full response for that API? About the conditions to trigger it, will show to the frontend? For example, ‘Current user company’ is ‘company’
And when I use Trigger a backend custom event – from either the backend, or now from the frontend – there are no direct WU costs for triggering the custom event, right?
In other words, Trigger a backend custom event by itself does not cost 0.6 WU for “Running a server-side workflow action”, right? (Although the custom event is likely to include a database lookup/search, which will cost both the 0.6 WU as well as the lookup/search WU costs.)
Now only the data you return is returned to the frontend!