As a complete beginner in this area I am looking at various Access Control libraries for my javascript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are libraries focusing on the backend side, and others on the client side (and a few that can be used on both).
This library e.g. has (by far) most github stars and seems to me a 'backend side solution':
'Client side solutions' e.g.:
My question is twofold:
- is my division into backend vs client solutions correct?
- when you have a client solution which using a router hides certain content, is this not a major security risk as the query brought all data (including 'classified' data) to local memory of the client. Can this not easily be compromised?