This repro requires several users and devices so first I will specify those pre-requisites, then add the steps to reproduce. This repro is anonymised as the people involved are children, as such no personal details will be included in this issue.
Prerequisites
Person A. This is the Realm Owner of a 3-person Bedrock Realm. This person accesses the Realm via XBox.
Person B. This person accesses the Realm via the Nintendo Switch. This person has been invited into the Realm via a gamertag invite. No invite links have been shared. They have accepted the gamertag invite.
Person C. This person uses the same physical Nintendo Switch device as Person B. This person has not been invited to the Realm via either gamertag invite or link sharing.
Persons B and C are both included in a family Nintendo online account by their parent.
Steps to Reproduce:
Person B logs into the Nintendo Switch and starts Minecraft.
Person B enters the Realm.
Once Person B has successfully entered the Realm, Person C turns on the second controller for the same Nintendo Switch device being used by Person B.
Person C presses + to join the game.
Person C selects their user account from the Nintendo Switch user selection screen.
Observed Results:
Person C successfully enters the Realm.
Expected Results:
Person C should not be able to enter the Realm because they have not been invited into the Realm nor do they have a shared link.
If this were "as designed" it would be clearly documented. Your official documentation on how to add people into realms makes no statement of the fact that such people can enter a realm without the realm owners consent. Neither does your documentation on blocking and removing players state that a realm owner is powerless to prevent such people from entering their realm. It is therefore a security vulnerability.
There are two resolution paths:
Clear and unambiguous documentation explaining this behaviour to the parents of children who expect a safe environment for their children to play in.
Fix the security vulnerability that is already known to you.
You as the product owners have the right to choose which resolution path to take but you must take one of them in order for this issue to be considered resolved.
gregcarter
REALMS-11966
This repro requires several users and devices so first I will specify those pre-requisites, then add the steps to reproduce. This repro is anonymised as the people involved are children, as such no personal details will be included in this issue.
Prerequisites
Steps to Reproduce:
Observed Results:
Person C successfully enters the Realm.
Expected Results:
Person C should not be able to enter the Realm because they have not been invited into the Realm nor do they have a shared link.
If this were "as designed" it would be clearly documented. Your official documentation on how to add people into realms makes no statement of the fact that such people can enter a realm without the realm owners consent. Neither does your documentation on blocking and removing players state that a realm owner is powerless to prevent such people from entering their realm. It is therefore a security vulnerability.
There are two resolution paths:
You as the product owners have the right to choose which resolution path to take but you must take one of them in order for this issue to be considered resolved.