A doubt about security of my APP

Ask for Help
1

I have a concern about the security of my APP.
I see that this topic has already been dealt with, but honestly I have not yet understood it well.

This is the scenario:

  • In my APP I’ve normal users and administrative users;
  • users data are hosted in the table UsersProfiles; all user data has an important level of privacy;
  • in the APP there is a TAB in which every normal user can view and modify his profile (telephone, address, date of birth, identity document, etc.).
  • The UsersProfiles table is not protected by ROW OWNERS (because the Admin must be able to access all the records of UsersProfiles) but in the TAB-UsersProfiles the Details is filtered with the “email is signed-in user” method.

What I would like to understand exactly is: the filter “email is signed-in user” acting on the client side or server side? That is, does the entire package of UsersProfiles records still arrive in the user’s device and then only the record that corresponds to the signed-in user is filtered in-App?
If so, I have a security problem.

Someone can confirm/help me to better understand?
And tips for adopting the best levels of data security would be very helpful for me right now.

Thanks in advance.

2

I think this is the case.

Mark has said in the past row owners is the best method to secure data but as you said here, you can’t apply it to your app.

I think they will announce a new solution soon regarding the “roles” of users in each app.

2 Likes
3

Thanks @ThinhDinh you are always so willing to give me right answers in zero time.
So I ask you this: if I were forced to set row owners on the User Profile table, I could, in your opinion, with another APP (an admin APP) access the same UsersProfiles table where, however, the Admin has the possibility to see all the records of UsersProfiles?

4

Yes that should work!

1 Like
5

Now I’m undecided whether to wait for the new user roles feature, or disassemble half an application and create a new one just for Admins.
I’m in a panic :slight_smile:
Thanks @ThinhDinh

6

If you can wait for this week, I advise you to wait.

5 Likes
7

@Roldy I’m curious what you ended up deciding – Admin app or roles? I’m looking at a similar situation but has not considered that reading the sheet from a different app bypasses the restrictions imposed by the row owner column.