I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged information from being leaked to an unprivileged user.
Say I have a list of users with the properties id, displayname, loginname and passwordhash. And say my app shows a list of all users. How do I prevent the password hashes from being sent to every client requesting this view?