I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other project providing an API. The API will be secured by role, meaning that you must be logged-in and have the right role(s) in order to access endpoints, however I was wondering whether there's much merit in securing the UI?
I'm not talking about SSL, as hopefully we'll be able to enforce that on both projects, but more about whether it's ok to just dump a single, large JS file onto a user's machine (once they've logged in with any role), regardless of which roles they have, and to rely on the API to secure the data?
I get the feeling I'm missing something fundamental here, but as far as I can see the only real risk is in terms of application logic in the UI being visible to all customers, although it would obviously be minified - and therefore obfuscated.
Apologies for the slightly vague question ... I'm afraid this is not an area in which I have much experience.