[security] Generated tokens are broadcast to all socket clients (by default)

[t2t2]

[daffl]

Oh dear. This can be fixed quickly though via:

app.service('auth/local').filter(() => false);

Which should probably be the default for all auth services (we don't need their events anwyay).
We were discussing turning off event dispatching by default so you have to enable it explicitly. It would be the more secure but also more confusing approach.

[ekryski]

👍 @t2t2 thanks for pointing it out. I was aware of this and have a note in the code but forgot to create an issue and completely forgot about it!

We'll get a fix in for this soon. In the mean time anyone can lock down their services by doing what @daffl mentioned.