Just for a little background. We have a express based server and a React app which uses HTTPS connection with JWT tokens to authenticate user and send appropriate information over Authentication Headers.
However, once the user logs in, the server also needs to send access control information about the user for conditional rendering. Is there a way to hide this information from the browser. At present, when the user logs in, the response of the post call contains the roles pertaining to the user.
I'd like to know if there is a way to hide the information from dev tools. We are leaning towards webcrypto to encrypt the roles data on server side and send it to client, but just wondering if there is a better way. Or if I am overthinking.