4 ms·
No. Abstracting away the client-server divide in web apps is a broken concept. The server runs in a trusted environment. You can trust the results of decisions
by yuliyp 13y ago
No. Abstracting away the client-server divide in web apps is a broken concept. The server runs in a trusted environment. You can trust the results of decisions it makes ("can the user write to this object?", "can the user see this object"). You can never trust the results of decisions client-side code makes, except insofar as they are a proxy of the intentions of the authenticated user on the other side of the interaction.
- reeses 13y agoI think 'abstraction' is the wrong term anyway. It has become a go-to term for "make the ugly go away."
- homakov 13y agoWell i got to disagree. If server responds "yes you can write to this object" client can represent form for writing but when he submits this form it depends on the server again. Client should not trust server as well. If server goes mad it still can be not compromising client-side (unless app was completely hacked and HTML was changed)