How do JavaScript access control libraries work and is a client solution not a security threat?

Question

As a complete beginner in this area I am looking at various Access Control libraries for my JavaScript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are libraries focusing on the backend side, and others on the client side (and a few that can be used on both).

This library e.g. has (by far) most github stars and seems to me a 'backend side solution':

• Node ACL

'Client side solutions' e.g.:

• Vue ACL
• Vue Browser ACL

My question is twofold:
1) Is my division into backend vs client solutions correct?
2) When you have a client solution which using a router hides certain content, is this not a major security risk as the query brought all data (including 'classified' data) to local memory of the client. Can this not easily be compromised?

Answer 1

1. Yes, your division makes sense; now focus on the backend (security), forget about the client (user experience). In short, for most applications, there's no such thing as client-side security for the website operator. Client-side security is about protecting the user from bugs/xss/phishing/etc. It can however be helpful to users to inform of forbidden actions, hide links they can't click on, or block content for monetization, customization, or internationalization, and a router plugin might help achieve those user goals.

2. Yes, if you ship info to a client they can see it, even if the default interface presented hides such data. If there's something you don't want a client to know/see/have, you can't give it to them.
   Consider news site paywalls where one can read the story in "view-source"; that's about the lowest of the low "hacker-wise", but the concept is the exact same: nature will find a way.