Secure response from Rails to AngularJS

Question

Please helpe me, I want to show an html element if user is admin else hide the element,

Example:

AngularJS:

$http.get('users.json'})
.success(function(data){

    //data user return true and the value true represents admin
    $scope.user = data.user;
});

HTML:

<h1 ng-show="user">Hello Admin</h1>

The problem here, anyone can open firebug or devTools and change user scope value.

I dont see why it matters: its only client side view, so even if someone changes it and sees 'admin', since the backend wont provide information, its no big deal — apneadiving
– apneadiving, Commented Jun 25, 2014 at 13:36
@apneadiving: I'm sure Hello Admin is not exactly what he is going to implement in the real app. It is going to be much more. (Admin stuff) — Sunny R Gupta
– Sunny R Gupta, Commented Jun 25, 2014 at 13:38
then what? thats not because you can see the box (view) that you have access to whats inside (secured by the backend) — apneadiving
– apneadiving, Commented Jun 25, 2014 at 13:39
but if you have a non secure backend... well... the base of security has always been backend, not frontend. Another example: hiding a link doesnt make it secure — apneadiving
– apneadiving, Commented Jun 25, 2014 at 13:41
I don't think the whats-inside is protected by the backend here. The attempt is to make a full client side app, and my solution below suggests that OP switches to an architecture where the admin stuff IS protected by the backend :) — Sunny R Gupta
– Sunny R Gupta, Commented Jun 25, 2014 at 13:41

Sunny R Gupta · Accepted Answer · 2014-06-25 13:43:02Z

1

You are absolutely right in guessing that the above method is not at all secure.

The solution is to either send the local data to the server and get it to return the secure content which is then dynamically injected into the dom.

i.e. Your Admin relevant stuff is not always present on the client side, and only after authentication is it fetched (via AJAX probably) and rendered.

This makes your app a bit more secure.

You might also want to look into the following mechanism for secure authentication on client side apps:

https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/

edited Jun 25, 2014 at 13:43

answered Jun 25, 2014 at 13:35

Sunny R Gupta

5,1461 gold badge33 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Secure response from Rails to AngularJS

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related