I would like some expert insight. I want to know what my vulnerabilities for this model are.
This is a demo project that I will be following in my production app if all works out securely. My production app will include hybrid encryption for ALL user-sensitive data. Nothing sensitive will ever be stored on the server unencrypted. I know I lose query capabilities but that's not the intention of this post. I solely and only want to know the vulnerabilities (if any) of this model below + hybrid encryption. I'm using Parse & Back4App.
My main concern (possibly paranoia) is unauthorized access causing data corruption. So, using ACLs in this way plus encryption...
What I’m doing is having users share their user ID via the server and store it locally for a list of authorized users in a group. Authorized users' ACLs will always write to each crud action.
Is this method of using ACLs vulnerable in any way?