I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged information from being leaked to an unprivileged user.

Say I have a list of users with the properties id, displayname, loginname and passwordhash. And say my app shows a list of all users. How do I prevent the password hashes from being sent to every client requesting this view?

1 Answer 1


Controlling who gets to see what is the responsibility of your application, not the protocol you use to connect your front-end to your back-end.

For example if you use a RDBMS you might use the query

SELECT id, displayname, loginname FROM users;

instead of

SELECT id, displayname, loginname, passwordhash FROM users;
  • What precisely do you mean by "application" in this answer? The Angular client the OP is talking of (the frontend)? Or frontend + backend together?
    – Doc Brown
    Jan 12, 2020 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.