I’m concerned about the security if I hide some tab icons or the back button using css in a public with email sign-in app.
I have different tabs, some for producers and some for customers and the tab bar at the bottom of the screen is hidden through css.
To restrict access to these tabs I have a menu tab with different buttons, visible only to producers or customers or both depending on entries in each row in the user sheet.
Now would it be possible through some tricks that a user changes the css setting and sees all tab icons at the bottom of the screen or the hidden back button on detailed screens?
Is it secure to hide some buttons for certain users with the visibility setting if the app has no user roles because it’s no private app?
Thanks for any ideas and hints.
Yes.
No. What you have there is security by obscurity. Good enough for the average user, but certainly not going to deter somebody that knows what they are doing and is curious or motivated enough to go looking.
A common approach to this problem is to build two apps - both pointing at the same Google Sheets/Glide Tables. The first app would be a Private Pro app, would contain all these admin type functions, and would be restricted to a smaller group of users. The second app would be Public (for everybody else), and wouldn’t contain any of that advanced functionality. With that approach, you can be certain that non-authorised users can’t get at functionality they that shouldn’t be able to, because that functionality won’t exist in the app.
@Darren_Murphy if that’s really a NO to my 2nd question I don’t understand this visibility feature, because any knowledgable person could compromise UX.
My app is public with email sign-in and row ownership in my users table. in each row I have a column with the user’s function which should be the criterion for showing or now showing a tab or other element.
Now I found an older post about this: https://community.glideapps.com/t/please-help-us-test-tab-visibility/10980. But I don’t know if I understand it right. @Robert_Petitto’s mentions in his comment that two separate apps shouldn’t be necessary any more.
It depends on how you have everything set up. CSS to hide a tab can easily be compromised because the object is still there, but visually hidden. If you use visibility rules to hide a tab based on a value in the user profile, then that should be more secure as that tab isn’t even sent to the user’s device. The thing you have to consider is the data that a hidden tab refers to. If you are not using row owners in that data, then it is still possible that it all could be downloaded to the user’s device, even though it may not be accessible through a tab.
Applying Row Owners to all data that needs it will prevent non-owned data from being downloaded to the device in the first place. I believe that tab visibility is the same and why it’s strongly tied to user profiles. Tabs hidden through tab visibility are not loaded on a user’s device, but again, non-protected data could still be downloaded.
3 Likes
@Jeff_Hager thank you for your argument, this is very helpful.
It think it would be good if such clarifications are added to the Security Center. 
2 Likes