Hide authentication code in controller sap ui5

[former_member685547]

Hi,

I have a custom sap ui5 app in which I have a condition check to test whether the user is authorized or not. I am making a odata call to check the authorization. But the thing is other developer can easily overwrite/change the authorization when he is in debug/developer tools mode(F12). This looks some kind of security threat for me. How to hide the security check code in my controller.js?

[former_member194549 · Accepted solution]

Hi,

never perform authorization checks in the frontend, because, as you have already mentioned, this can easily be bypassed.
Implement any authorization checks in the backend, which the user has no influence on!

Of course you can e.g. hide a create button in the UI if the user has no permission to create the object. In the back-end service, however, this authorization must be checked again before the object is created.

Regards
Simon

[thomas_arnesen · Accepted solution]

As I always say; "Never trust user input".