As a complete beginner in this area I am looking at various Access Control libraries for my JavaScript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are libraries focusing on the backend side, and others on the client side (and a few that can be used on both).

This library e.g. has (by far) most github stars and seems to me a 'backend side solution':

'Client side solutions' e.g.:

My question is twofold:
1) Is my division into backend vs client solutions correct?
2) When you have a client solution which using a router hides certain content, is this not a major security risk as the query brought all data (including 'classified' data) to local memory of the client. Can this not easily be compromised?

  • 1
    Access control cannot be implemented securely on the client. It must be enforced on the server. – jfriend00 Oct 22 '17 at 14:38
  1. Yes, your division makes sense; now focus on the backend (security), forget about the client (user experience). In short, for most applications, there's no such thing as client-side security for the website operator. Client-side security is about protecting the user from bugs/xss/phishing/etc. It can however be helpful to users to inform of forbidden actions, hide links they can't click on, or block content for monetization, customization, or internationalization, and a router plugin might help achieve those user goals.

  2. Yes, if you ship info to a client they can see it, even if the default interface presented hides such data. If there's something you don't want a client to know/see/have, you can't give it to them.
    Consider news site paywalls where one can read the story in "view-source"; that's about the lowest of the low "hacker-wise", but the concept is the exact same: nature will find a way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.