As a complete beginner in this area I am looking at various Access Control libraries for my JavaScript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are libraries focusing on the backend side, and others on the client side (and a few that can be used on both).

This library e.g. has (by far) most github stars and seems to me a 'backend side solution':

'Client side solutions' e.g.:

My question is twofold:
1) Is my division into backend vs client solutions correct?
2) When you have a client solution which using a router hides certain content, is this not a major security risk as the query brought all data (including 'classified' data) to local memory of the client. Can this not easily be compromised?

  • 1
    Access control cannot be implemented securely on the client. It must be enforced on the server.
    – jfriend00
    Oct 22, 2017 at 14:38

1 Answer 1

  1. Yes, your division makes sense; now focus on the backend (security), forget about the client (user experience). In short, for most applications, there's no such thing as client-side security for the website operator. Client-side security is about protecting the user from bugs/xss/phishing/etc. It can however be helpful to users to inform of forbidden actions, hide links they can't click on, or block content for monetization, customization, or internationalization, and a router plugin might help achieve those user goals.

  2. Yes, if you ship info to a client they can see it, even if the default interface presented hides such data. If there's something you don't want a client to know/see/have, you can't give it to them.
    Consider news site paywalls where one can read the story in "view-source"; that's about the lowest of the low "hacker-wise", but the concept is the exact same: nature will find a way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .