title: sails: disable `blueprints actions` in production, since it creates a huge security footprint?
body: <p>Getting acquinted with <a href="http://sailsjs.org/#!" rel="nofollow">Sails</a> for Node.</p>
  
  <p>One thing I need to get used to is the 'automagic' way in which routes for controller-methods are set-up using <code>blueprints</code>. </p>
  
  <p>For example, from the docs, if <code>actions</code>-blueprints are enabled (<strong>which they are by default</strong>) GET, POST, PUT, and DELETE routes will be generated for every one of a controller's actions.</p>
  
  <p>E.g from the docs, when you've got controlled-method <code>EmailController.send</code> the following routes are created: </p>
  
  <pre><code>     * `EmailController.send`
       * :::::::::::::::::::::::::::::::::::::::::::::::::::::::
       * `GET     /email/send/:id?`
       * `POST    /email/send/:id?`
       * `PUT     /email/send/:id?`
       * `DELETE  /email/send/:id?`
  </code></pre>
  
  <p>The docs specifically state: <code>actions</code> are enabled by default, and are OK for production-- however, you must take great care <strong>not to inadvertently expose unsafe controller logic to GET requests</strong>.</p>
  
  <p>Normally I would write a controller-method for ONE specific HTTP Verb (e.g.: POST). That's clearly <strong>not</strong> compatible with this automagic wiring, since these methods would be exposed on GETs (and PUTs and DELETEs) as well, which would leave a huge security footprint imho.</p>
  
  <p>So: what's the practical use of enabling these <code>actions</code>? To me, it seems like a huge security risk. On the other hand, I can (theoretically) imagine writing <strong>all</strong> controller methods with conditional logic to discriminate between HTTP VERBS , but for most controller methods this just doesn't make sense. </p>
  
  <p>So help me out: What's the advantage of working with these <code>actions</code> which Sails seems to try to nudge me towards?  Or is it just a way to get going quickly, but really not meant for production?</p>
  
  <p>Thanks for wrapping my head around this. </p>