Login security with conditional logic on the client

[campopianoa]

My approach is to authenticate on the server side before returning sensitive data. That is, I assume that the user can make the client-side interface do anything they want if they are clever enough (e.g., change flags, visit pages, etc…); however, I control what is returned from the servers.

Please see Bridget’s helpful post:

Anvil.users.get_user() and security

Hi @hans.melberg, As @david.wylie and @stucork have suggested, it’s good practice to perform validation checks on both the client-side and server-side. I normally use an alert to display validation errors on the client-side, and raise an Exception server-side in response to validation errors. You might find this how-to guide in the docs helpful. If you’re using the Users Service, you can also customise your @anvil.server.callable decorators inside your Server Modules to check that a user is lo…