0

I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged information from being leaked to an unprivileged user.

Say I have a list of users with the properties id, displayname, loginname and passwordhash. And say my app shows a list of all users. How do I prevent the password hashes from being sent to every client requesting this view?

bumped to the homepage by Community 2 days ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

0

Controlling who gets to see what is the responsibility of your application, not the protocol you use to connect your front-end to your back-end.

For example if you use a RDBMS you might use the query

SELECT id, displayname, loginname FROM users;

instead of

SELECT id, displayname, loginname, passwordhash FROM users;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.