I am building an internal admin panel for my team that will communicate to the backend server using a REST API.

One of the API calls that will be performed will be an "authorization check" where the frontend will ask for the logged-in user's roles.


GET /admin/user/roles

  "permissions": "REPORTS_ONLY"


How do I protect my application so that a user cannot intercept the response (via a Chrome/Firefox extension) and "elevate" their role to see more of the UI than than should be allowed to see?

  • 2
    Is there a reason you can't have permissions fully managed by the backend? i.e. why does the frontend need to know the permission level, can't it just send the user's credentials and the backend decides whether or not to allow a particular action? The only reason the frontend should need to retrieve the permission level in a typical webapp is for display purposes. – Buffalo5ix Feb 26 '19 at 17:34
  • The frontend is a standalone application. The only way it can communicate with the backend is via HTTP requests. So, all the permissions will be enforced by the backend. My question pertains to the UI-part of it. I don't want the curious mind to snoop around by spoofing the response and seeing more than they should, in the navigation menu, for example. – RainSear Feb 26 '19 at 17:37
  • 2
    If there is part of the navigation that you don't want seen, then you cannot send it to everyone as part of the frontend. Is there any particular reason you want to keep parts of the navigation menu secret? – AndrolGenhald Feb 26 '19 at 17:41
  • Like @AndrolGenhald said - if you're using the frontend to obscure information (such as part of the nav menu), you have a security problem. That data should never be getting sent to the frontend in the first place - assume any data sent to the frontend is fully visible to the user, because it is to anybody using a proxy. All access control has to be handled by the backend. You'll have to decide what nav menu elements the user is allowed to see, and send them only those elements, on the backend. – Buffalo5ix Feb 26 '19 at 17:58

Preventing the user from modifying requests before they are rendered in the browser is impossible. Any data which the user should not see should not be returned from the server.

In order to do this, you will need to check the users role on the server when querying for the data or performing a particular action. How you accomplish this is going to depend on the framework you are using and the architecture of your application. Most application development frameworks have a built-in form of role-based authorization. Googling around for "{insert framework name here} role based authorization" should help point you in the right direction.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.