I am developing a system to be used internally within a company, but possibly also externally at some point in the future. From the standpoint of the system's initial users - staff, the program is open source, as they have access to the repository where code is stored. They don't have access to server configuration, databases and such.
The system is web based and there are several classes of users, each with their limitations regarding what they can see and do. I'm not going to discuss the exact authentication and authorization mechanisms in use, as I think that would be beyond the scope of the question. Let's assume one is unable to trick the server into doing something he or she is not allowed to do or see (in terms of content, like articles).
With little fiddling with cookies you can enable the admin interface as it is included in site resources anyhow. You can see what it looks like and you can see what it could do. Meanwhile, you cannot actually do anything with it, as the server would know you are not a privileged user and decline to satisfy any requests you make, that you wouldn't normally be able to do.
I can't find any issue from usability standpoint as only "hackers" would run into a glitched admin interface and no regular users.
I am looking for negative implications from security standpoint.
My questions are:
- What would the benefit to an attacker be if they could see client-side code they are not supposed/allowed to use?
- Is having such functionality exposed a really bad practice I should immediately address?
- If we assume this is open software (and it is, currently, from the employees' standpoint), would hiding privileged users' tools be just some sort of security by obscurity, since an attacker could check the source code anyway?