Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Browser support? #55

Open
probil opened this issue Jul 24, 2019 · 4 comments
Open

Browser support? #55

probil opened this issue Jul 24, 2019 · 4 comments

Comments

@probil
Copy link

probil commented Jul 24, 2019

This library is for node but we used it in browser as well.

The only issue we have is that currently library supposed to work on node@6+ and up and as result some of the code throws errors in older browsers (IE, etc) since it contains new ES6 syntax.

I think it can be configured to support browsers by few lines of code in .babelrc.
I can create PR for that

@alejosv
Copy link

alejosv commented Aug 24, 2020

RBAC on the client side? For a security issue I don't think it's a good idea.

@probil
Copy link
Author

probil commented Aug 25, 2020

@alejosv Why do you think so? We have proper data protection on the server. It's not about security but more about code reuse. We use rbac on client side in production for at least a year to guard some routes in SPA and hide/display some blocks based on user permissions.

For example, if you can't create a post you won't see a button Create a post. But even with that button in place server would response with an error (no permission) - so no security issue here

@alejosv
Copy link

alejosv commented Aug 26, 2020

RBAC is not a UI/UX pattern, good practice or design, but rather, it is part of the INCITS 359-2012 standard. In a simple way, the RBAC must define which role has permission to which accesses. Because the management of users, roles and permissions are on the server side, the management must be in the same way.

The response sent by the server should not hide/show elements of the DOM, since it can be manipulated by anyone. Items must be created or not created based on their role. Angular and Vuejs have directives for these cases and common layout patterns like MVC allow in the view to create or not elements in the DOM, this avoids exposing elements that give access to non-granted resources or unwanted shares.

This way a client-side RBAC is not necessary and can be a major security breach.

@seeden
Copy link
Owner

seeden commented Aug 26, 2020

@alejosv you are right, but you can use it also just for simple cases like "can I show this button/navigation"? The backend can return "You are not allowed" when the client try to read something without rights.
I am not using it in this way because I am returning directly what the user is able to do or see from the backend. But for somebody, it can be interesting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants