[Question]: Very confused about externalId and security

[k2xl]

How can we help?

I'm hacking on a mobile app and trying to figure out how to sync external id and email with the user that registered for the notifications. However, based on the docs - it seems that the client can set this...

In other words, can any client call OneSignal.User.addEmail and then pass in anyone else's email?? Wouldn't this mean they are able to steal notifications from others if email is used as a targeting?

I'm creating a backend server endpoint as I would like to do this linking server side using the oneSignalId (i.e. i pass in the oneSignalId to the endpoint and then link the currently logged in user). Since there is a server rest api key that seems to be safer...

However, the SDK still seems to allow it locally so unclear how to stop someone from doing this.

[netizen-ais]

I've asked that last year, they said coming soon