Just for a little background. We have a express based server and a React app which uses HTTPS connection with JWT tokens to authenticate user and send appropriate information over Authentication Headers.

However, once the user logs in, the server also needs to send access control information about the user for conditional rendering. Is there a way to hide this information from the browser. At present, when the user logs in, the response of the post call contains the roles pertaining to the user.

I'd like to know if there is a way to hide the information from dev tools. We are leaning towards webcrypto to encrypt the roles data on server side and send it to client, but just wondering if there is a better way. Or if I am overthinking.

Thank you.


In web application clients, we can give user access information in plain mode and instead secure our server API. my mean, although the user can see some pages (if they break their credential and change it) they don't seed any data in it. cause data is coming from our API and API should check the JWT and its user and check its permissions then return required pieces of information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.