I need help understanding a problem I have, and that others surely have had as well.

I'm working on a web-application that allows users to interface with a database. The application in general has multiple pages with tabbed navigation, that displays and allows most content to be editable. So far, it works well.

I need to restrict access to certain pages and disable dynamic (editable) content of the application based on the group (in the database) that the User belongs to, sounds simple, maybe it is. The issue is though, the editable pages have input of type buttons and text which should disappear for a user in a restricted group. Also, certain tabbed-navigation selections should not be displayed for Users of a restricted group. At what point in my application should this logic be handled?

Using javascript for this logic seems like the wrong approach (using a library like underscore.js with templates), but I do need to hide or disable multiple options. My other thought was having dynamic and static web-pages and serve those based on User group.

It's clear that I'm lost on this subject, and could use some insight as how this problem should be approached in a way that is sane so the next guy behind me won't say...wtf.

I'm not sure if this question is better suited for stackoverflow or here. So hopefully this is the right place!


This type of thing is usually handled by a server-side script: if a user is logged in, and has permission to edit the page, the script inserts suitable controls into the HTML output. Also, whenever any request is received that is related to page editing, the check needs to be repeated; if it's not, it is very easy for malicious users to circumvent the protection (guessing the correct URL is all it takes).

Doing this on the client side is not really an option; client-side script can be modified by the user, and there is absolutely nothing you can do about that. You can insert the editing controls client-side, but the permission check absolutely has to happen on the server, otherwise bypassing it is as simple as changing a variable value in the javascript console (or by typing a javascript: URL into the address bar if you're really old-school).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.