# šŸ†• Security Center **URL:** \ **Category:** General\ **Created:** [September 30, 2020, 12:19am UTC](https://community.glideapps.com/t/security-center/16542 "2020-09-30T00:19:06Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 5, 2020, 1:16pm UTC](https://community.glideapps.com/t/security-center/16542/41 "2020-10-05T13:16:51Z")
@david @Mark I have a query about a specific scenario that I keep coming up against and which I think still requires me to utilise 2x Pro apps for security reasons. Iā€™ll try to explain: Imagine a customer who has a restaurant business. They have public information that anyone can see and also member sign in for customers who are part of their loyalty scheme. So my app is Public Pro but supports user profiles. Thatā€™s all good. Now imagine that the public section of the app displays latest offers and new menu items. Somebody needs to ā€œadministerā€ those details i.e. add new items. Typically this will be one or more members of staff. I had thought this could be handled by a simple Admin flag in the user profiles table. The flag would use visibility to enable adding and editing of such items. However, based on my understanding, this is easily bypassed. Using the browser inspect element capability a malicious person could alter the Admin flag amd therefore gain visibility and access to the lates offers etc. Clearly an issue. So it seems that I have to revert to another app, just for Admin users. Am I getting this straight guys? If so then Iā€™m back into double costs again ā˜¹ ---
**Author:** ![david](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/david/32/62831_2.png) [@david](https://community.glideapps.com/u/david)\ **Post date:** [October 5, 2020, 3:51pm UTC](https://community.glideapps.com/t/security-center/16542/42 "2020-10-05T15:51:29Z")
Just make sure to use multiple row owners for the staff who are editing in this case, and display the readable deals in a mirrored sheet. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 5, 2020, 4:32pm UTC](https://community.glideapps.com/t/security-center/16542/43 "2020-10-05T16:32:51Z")
Hi @david - thanks for the reply - two queries: Regarding the mirrored sheet technique, am I right in assuming that this all happens in Google ie. we have a sheet with the ā€œsourceā€ rows in protected by row owners and then use a Google formula to ā€œduplicateā€ these into another sheet which the public (and other non-admin) users read? Regarding the multiple row owners, I have yet to find a way of implementing this technique ā€œdynamicallyā€ so that the customer can allocate and de-allocate their own admin users as they deem fit. Can you suggest a way forward? Cheers. ---
**Author:** ![Jeff\_Hager](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/jeff_hager/32/43_2.png) [@Jeff\_Hager](https://community.glideapps.com/u/Jeff_Hager)\ **Post date:** [October 5, 2020, 5:01pm UTC](https://community.glideapps.com/t/security-center/16542/44 "2020-10-05T17:01:54Z")
That would be my take on mirrored sheets. As for multiple row owners, my take is that you would have an array of columns set up in the sheet to use for row owners. One column would be set up for the customer and any other columns could be edited by the customer to assign admins. So they would edit individual columns, but you would use the combined array for setting row owners. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 5, 2020, 5:18pm UTC](https://community.glideapps.com/t/security-center/16542/45 "2020-10-05T17:18:12Z")
Thanks @Jeff_Hager. The issue with the multiple row owners, as I see it, is how do I allow for a customer who might have just one or maybe 20 admins? They will only have the app UI available to edit their admin allocations. No access to the sheet. So I am therefore probably stuck with adding in, say, 50 columns ā€œjust in caseā€ and then trying to build the UI to populate them (or not) sequentially? ---
**Author:** ![Deena](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/deena/32/9877_2.png) [@Deena](https://community.glideapps.com/u/Deena)\ **Post date:** [October 5, 2020, 10:22pm UTC](https://community.glideapps.com/t/security-center/16542/46 "2020-10-05T22:22:43Z")
Forgive me if I am wrong, and definitely need someone from glide to confirm this, but I believe that anyone with a role of admin can be added to the array. So you would not have to do any manual work there. Or build a bunch of columns. You would just have to assign them the role of admin. ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 1:21am UTC](https://community.glideapps.com/t/security-center/16542/47 "2020-10-06T01:21:41Z")
Deena is right. The setup should be like this if I understand everything right: - In the User Profiles, have a Roles column that sets the ā€œAdminā€ text value to the column that you will use as ā€œRolesā€. Other values can be user etc. - In the other sheets, have a corresponding Visible Rows 1, Visible Rows 2 etc. On rows you want to show to Admin only, give it only an admin value. If you need the user to see it as well, add ā€œUserā€ to Visible Rows 2 and so on. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 6, 2020, 7:29am UTC](https://community.glideapps.com/t/security-center/16542/48 "2020-10-06T07:29:35Z")
@Deena and @ThinhDinh thanks for your input. I have been thinking more about this and I still donā€™t fully understand your suggestion if Iā€™m honest. My current belief is that the ONLY thing we can be sure of is that Glide will return only rows where the current logged-in user is a row owner. This is not an ā€œapp visibilityā€ trick because the non-matching rows are not ā€œhiddenā€ - they are not even returned to the app. In the case of visibility, however, data is returned, but the app uses logic to hide that data. Itā€™s actually there, in the app, but hidden, so we can change our logic to show it based on certain conditions if we wish. The second scenario is not secure since it is possible, using the browser inspect element function for example, to view this data and even to CHANGE it app-side. This means that one could change the value of, say, the Admin flag in a returned row from the User Profile sheet. Then the various visibility rules that depend on the flag would trigger. So returning to my scenario, there is a sheet that holds, say, a row for each item that the restaurant sells with a name, description, photo and price. Public users and customers (who will have user profiles) should be able to see this entire sheet freely BUT not edit it. One or more members of staff (who also have user profiles) should be able to edit this entire sheet. It SHOULD be possible to do this in a single app. @David has proposed using sheet mirroring and I get that bit. The ā€œmasterā€ sheet can be made available for staff to edit and we can use a Google sheet formula (not yet tried this) to duplicate the entire sheet into a ā€œslaveā€ copy which everybody can read. So far so good. However the only way to restrict access to the ā€œmasterā€, without relying on visibility, is to use row owners. I know that we can assign a single row owner to a row or multiple row owners by using an array column. However I do not know in advance how many row owners are required and who they are. These are essentially the staff and will be configured by the restaurant from the app UI. We have to do it this way because Glide does not yet support built-in ā€œrolesā€. So the question remains, how do I allow the end user, via the same app, to manage the staff users who have the ability to update the ā€œmasterā€ sheet in a secure manner? If I do this based on any flag in the user profile row then I imagine it can be easily circumvented? Or am I totally missing the point somewhere! Thanks in advance for any guidance. ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 8:24am UTC](https://community.glideapps.com/t/security-center/16542/49 "2020-10-06T08:24:46Z")
> [@V88](#): > > However I do not know in advance how many row owners are required and who they are. These are essentially the staff and will be configured by the restaurant from the app UI. We have to do it this way because Glide does not yet support built-in ā€œrolesā€. They do now, with Sheet columns, if thatā€™s what you want to refer to. > **[Glide Docs](https://www.glideapps.com/docs)** > > Welcome to Glide Docs, a steadily growing collection of articles and videos on how to use Glide. We canā€™t wait to see what you build! ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 6, 2020, 9:00am UTC](https://community.glideapps.com/t/security-center/16542/50 "2020-10-06T09:00:40Z")
Wow. Thatā€™s interesting and potentially VERY powerful indeed. However I still foresee two issues: 1. There is this restriction: 2. What stops a user changing their role in the browser ā€œinspect elementā€ @Mark can you provide any assistance / guidance here please? My potential customer is asking for clarification and Iā€™m struggling without adopting the ā€œdual appā€ approach. ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 9:12am UTC](https://community.glideapps.com/t/security-center/16542/51 "2020-10-06T09:12:30Z")
Can you specify the changing role in browser ā€œinspect elementā€ part? I thought those pieces of info are now all secured via base64 coding. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 6, 2020, 9:23am UTC](https://community.glideapps.com/t/security-center/16542/52 "2020-10-06T09:23:11Z")
Yes Iā€™ll try. I am no security expert, however if you run a Glide app in the browser then you can right-click inspect element to view the HTML elements. Everything that has been sent to the app will be available for you to see in here and also to change (of course only in the browser not at source). I am assuming that your user profile information is also in here somewhere (the app would need it for visible checks etc). Therefore I assume that you can also see the contents of the role column for your profile. And therefore change it? This is why I am seeking some clarity. I have users asking questions about data security, for obvious reasons, and whilst I feel comfortable with the ā€œdual appā€ approach I do not know enough about Glide to feel just as comfortable with the ā€œsingle appā€ approach. ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 9:32am UTC](https://community.glideapps.com/t/security-center/16542/53 "2020-10-06T09:32:01Z")
My understanding is: - Glide loads the data you want them to load to the end user via a JSON. - You can control that using the old row owner approach, or this new roles approach. - The JSON file is now secured via base64 coding, and it takes into account your roles settings so only sheets without those will now load to the JSON. Me and Deena did test this to confirm the JSON wonā€™t expose data anymore and it doesnā€™t. - Iā€™m not entirely sure about changing a ā€œflagā€ to change the role column, but that should not be possible because itā€™s only a ā€œlocalā€ settings on that specific session and that should not initiate a ping back to the Sheet to show new data. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 6, 2020, 9:38am UTC](https://community.glideapps.com/t/security-center/16542/54 "2020-10-06T09:38:29Z")
Hey @ThinhDinh thatā€™s really interesting and good to know that @Deena and you have both been looking at this. It would be great to get confirmation from @david or @Mark or any other Glide Team member about how this works. Do you know if that currently exists on any other post that I may have missed? Thanks. ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 9:50am UTC](https://community.glideapps.com/t/security-center/16542/55 "2020-10-06T09:50:17Z")
![image](https://us1.discourse-cdn.com/flex002/uploads/glideapps/original/2X/8/885c3996730c8756dd46dab2820c63f399f9ea96.png) I donā€™t think I have seen the ā€œRolesā€ mentioned anywhere else but I think there will be more Glide communication regarding role-based security and protected columns in the coming days. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 6, 2020, 10:03am UTC](https://community.glideapps.com/t/security-center/16542/56 "2020-10-06T10:03:44Z")
Aha. That also sounds ā€œsuper interestingā€. I imagine thatā€™s what theyā€™ve been working on. Iā€™m sure itā€™s a very significant undertaking. May I ask where you got that Updates screenshot from? As an aside, I wonder if protected columns answers my various ramblings above? ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 10:15am UTC](https://community.glideapps.com/t/security-center/16542/57 "2020-10-06T10:15:11Z")
[https://docs.glideapps.com/all/guides/security-center](https://docs.glideapps.com/all/guides/security-center) Itā€™s in the link David posted haha. Me and @Deena only tried role-based security, seems like protected columns are not out yet. ---
**Author:** ![V88](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/v88/32/90054_2.png) [@V88](https://community.glideapps.com/u/V88)\ **Post date:** [October 6, 2020, 10:31am UTC](https://community.glideapps.com/t/security-center/16542/58 "2020-10-06T10:31:31Z")
Oh yes. Itā€™s changed since I looked at it last time. Also I didnā€™t see an Announcement for roles, so maybe thatā€™s yet to come. Thanks so much for the ā€œchatā€. Itā€™s been really useful. Letā€™s see if @david or @Mark can chime in here to just nail my customer response, even if itā€™s just to say ā€œyes itā€™s coming soonā€. Cheers @ThinhDinh ---
**Author:** ![ThinhDinh](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/thinhdinh/32/49_2.png) [@ThinhDinh](https://community.glideapps.com/u/ThinhDinh)\ **Post date:** [October 6, 2020, 10:35am UTC](https://community.glideapps.com/t/security-center/16542/59 "2020-10-06T10:35:28Z")
Have a nice week yourself man! Hope the chat helps! ---
**Author:** ![Mark](https://sea2.discourse-cdn.com/flex002/user_avatar/community.glideapps.com/mark/32/125_2.png) [@Mark](https://community.glideapps.com/u/Mark)\ **Post date:** [October 6, 2020, 12:53pm UTC](https://community.glideapps.com/t/security-center/16542/60 "2020-10-06T12:53:16Z")
We hope to ship protected columns within a week. [Previous page](https://community.glideapps.com/t/security-center/16542.md?page=2) [Next page](https://community.glideapps.com/t/security-center/16542.md?page=4)