4 ms·
Does it really matter if the user gains access to a part of the app that they don't have authorization for? It's up to the API to enforce what the users are or
by pyre 12y ago
Does it really matter if the user gains access to a part of the app that they don't have authorization for? It's up to the API to enforce what the users are or aren't allowed to see, otherwise they can just by-pass the browser all together and make requests to the API willy-nilly.
- crudbug 12y agoIt exposes your application structure.
- pyre 12y agoI guess this only matters for specific types of apps (e.g. unlock functionality when a user pays) where most of the action happens client-side? Still seems like security-through-obscurity because eventually the user ends up with the client-side code.
- bmm6o 12y agoWhat's the threat model here? That a potential attacker knows more about your application? Then what?