From their newsletter which just went out, can't find a link online.
"Please make sure it's reasonably secure. Meteor security isn't as hard
as people think. Admittedly it doesn't yet have the delicious "candy
coating" that the database and DOM update stuff has, but we didn't,
like, forget to put any in. Here's what Made With does:
* Use Meteor.publish() and Meteor.subscribe() to control what clients
can see (remove the 'autopublish' package first). Actually you may not
need to do this for a blog.
* Use Meteor.methods() and Meteor.call() to define secure server
functions and call them from the client. Then lock down your app by
disabling the "training wheel" methods that let any client do any
write."
Also from a quick skim of the server code itself it looks like they are using connect, so you it's possible that you could roll something up using a connect middleware package like everyauth. [1]
That would mean hosting your own server though rather than using the simple meteor deploy.
[1] http://everyauth.com/
"Please make sure it's reasonably secure. Meteor security isn't as hard as people think. Admittedly it doesn't yet have the delicious "candy coating" that the database and DOM update stuff has, but we didn't, like, forget to put any in. Here's what Made With does:
* Use Meteor.publish() and Meteor.subscribe() to control what clients can see (remove the 'autopublish' package first). Actually you may not need to do this for a blog.
* Use Meteor.methods() and Meteor.call() to define secure server functions and call them from the client. Then lock down your app by disabling the "training wheel" methods that let any client do any write."
Also from a quick skim of the server code itself it looks like they are using connect, so you it's possible that you could roll something up using a connect middleware package like everyauth. [1]
That would mean hosting your own server though rather than using the simple meteor deploy.
[1] http://everyauth.com/