bootstrap-flow-router - Can see private stuff without login

[jfer77]

The router.js is a client and server component. In the file i have the following route:

FlowRouter.route('/', {
  name: "home",
  action: function(params, queryParams) {
    BlazeLayout.render('masterLayout', {
      footer: "footer",
      main: "home",
      nav: "nav",
    });
  }
});

With that code i'm directly routed to the home template. Which working great. if i clicking on private, I have to login to see the content of private template.

But if I change the template home by private like so:

FlowRouter.route('/', {
  name: "home",
  action: function(params, queryParams) {
    BlazeLayout.render('masterLayout', {
      footer: "footer",
      main: "private",
      nav: "nav",
    });
  }
});

When the page refreshes I have the template private without asking any login
=> This is private stuff!

The problem is that the client can change himself the value in the router.js as it is client file. Eventhough the server shouldn't give any data, the client access the template.