How to prevent angular 2 client from accessing privileged fields

Question

I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged information from being leaked to an unprivileged user.

Say I have a list of users with the properties id, displayname, loginname and passwordhash. And say my app shows a list of all users. How do I prevent the password hashes from being sent to every client requesting this view?

Answer 1

Controlling who gets to see what is the responsibility of your application, not the protocol you use to connect your front-end to your back-end.

For example if you use a RDBMS you might use the query

SELECT id, displayname, loginname FROM users;

instead of

SELECT id, displayname, loginname, passwordhash FROM users;