How safe are angular route guards? [duplicate]

Question

I'm making an online store, and there's an administration part from where you can track orders and modify them.

It is protected by authentication, which is done on a node server, passwords is hashed into DB etc. but I'm worried about the route guard still being bypassed.

Henslowe

Answer 1

You should be worried.

Route guards provide exactly zero security, like anything else that you implement on the client side. Things you implement on the client side can only be for the users convenience, but not for security.

You need to enforce security on the server side.

Kavanaugh

+1. Just curious how we enforce the security on the side side so we can be absolutely sure that the users cannot view the routes that they don't have access to? – Lietman

Not sure what you mean. There is no way to enforce anything in the browser. You can always modify the source or even build your own client. If you mean without considering the user modifying the source, the route guards are safe enough. – Galvanoscope

Oops sorry my stupid typo. I meant how do we enforce security on the server side so we can be absolutely sure that users cannot view something that they are not supposed to be viewed?. For example: Say I have a super secured API. That doesn't prevent the users from mucking with the Javascript and trick the router guard to viewing a protected page's UI (of course the data is protected. But can't they just see the structure of that page). Or can they even do that? – Lietman

I don't understand why you want to prevent someone seeing the app structure. It should be possible to use lazy loading to split your app, for example user and admin part and prevent non-admin users from downloading that part in the web server. If you lazy load modules then Angular should split them up into different files when you build the app. – Galvanoscope

Right exactly. I was trying to say admin part vs non-admin part. So yes, your example makes sense. So lazy loading is the way to go. Thanks for your patient responses. – Lietman

You also need to restrict the webserver to serve the admin module to admin users only. Lazy loading alone is not enough. A malicious user could still download the module using curl/wget or similar. – Galvanoscope