As a complete beginner in this area I am looking at various Access Control libraries for my javascript webapp (Vue.js PWA). I do not know if understand things correctly but it looks like there are libraries focusing on the backend side, and others on the client side (and a few that can be used on both).

This library e.g. has (by far) most github stars and seems to me a 'backend side solution': 

 - [Node ACL][1]

'Client side solutions' e.g.:

 - [Vue ACL][2]
 - [Vue Browser ACL][3]

My question is twofold:
1) is my division into backend vs client solutions correct?
2) when you have a client solution which using a router hides certain content, is this not a major security risk as the query brought all data (including 'classified' data) to local memory of the client. Can this not easily be compromised?


  [1]: https://github.com/OptimalBits/node_acl
  [2]: https://github.com/leonardovilarinho/vue-acl
  [3]: https://github.com/mblarsen/vue-browser-acl