3 ms·

To further your port Agno, you regularly have all of the javascript modules in the browser, even if the user doesn't have the right authentication role to use t

To further your port Agno, you regularly have all of the javascript modules in the browser, even if the user doesn't have the right authentication role to use those modules. I'm currently trying to find a way to only download the modules only if the user has the proper authentication and then load them into the already bootstrapped angular, but it isn't easy.

avoid3d 12y ago
This sounds like security through obscurity, made worse by the fact that it is probably difficult to guarantee that users who are shown the 'privileged' modules are somehow to be trusted.
pyre 12y ago
Does it really matter if the user gains access to a part of the app that they don't have authorization for? It's up to the API to enforce what the users are or aren't allowed to see, otherwise they can just by-pass the browser all together and make requests to the API willy-nilly.
- crudbug 12y ago
  It exposes your application structure.
  - pyre 12y ago
    I guess this only matters for specific types of apps (e.g. unlock functionality when a user pays) where most of the action happens client-side? Still seems like security-through-obscurity because eventually the user ends up with the client-side code.
  - bmm6o 12y ago
    What's the threat model here? That a potential attacker knows more about your application? Then what?
meowface 12y ago
I don't think it's necessary to hide that functionality, unless there are some strings in the post-auth modules that unauthenticated clients should really never be able to see. Security by obscurity is pointless. You shouldn't be concerned about someone having all of your client-side source code; the worst they could do with it is clone your site and make a bad, hacky reverse engineered attempt at emulating your backend API. If you think hiding your application structure or references to API endpoints secures you, then you're doing something very wrong.

avoid3d 12y ago

This sounds like security through obscurity, made worse by the fact that it is probably difficult to guarantee that users who are shown the 'privileged' modules are somehow to be trusted.

pyre 12y ago

Does it really matter if the user gains access to a part of the app that they don't have authorization for? It's up to the API to enforce what the users are or aren't allowed to see, otherwise they can just by-pass the browser all together and make requests to the API willy-nilly.

crudbug 12y ago
It exposes your application structure.
- pyre 12y ago
  I guess this only matters for specific types of apps (e.g. unlock functionality when a user pays) where most of the action happens client-side? Still seems like security-through-obscurity because eventually the user ends up with the client-side code.
- bmm6o 12y ago
  What's the threat model here? That a potential attacker knows more about your application? Then what?

meowface 12y ago

I don't think it's necessary to hide that functionality, unless there are some strings in the post-auth modules that unauthenticated clients should really never be able to see. Security by obscurity is pointless. You shouldn't be concerned about someone having all of your client-side source code; the worst they could do with it is clone your site and make a bad, hacky reverse engineered attempt at emulating your backend API. If you think hiding your application structure or references to API endpoints secures you, then you're doing something very wrong.