2 ms·
Fundamentally, authentication when someone tries to delete a thing needs to happen in server-side logic, not on the client side. The rest is flavouring.
by ben0x539 12y ago
Fundamentally, authentication when someone tries to delete a thing needs to happen in server-side logic, not on the client side. The rest is flavouring.
- vkjv 12y agoAuthentication should happen server side, but authentication need not happen at the time of delete. When deleting, you should be authorizing and validating, which can safely be done client side... but, if you are doing something server-side (e.g., a delete) you should also be doing it server side.
- TillE 12y agoHTTP is stateless. You need to generate some kind of token that can be checked for each admin action a user takes.