Displaying different data depending on login status - client side

Question

Hey all,

I was just wondering what the best way to do this is and if it could be bypassed. These are my thoughts.

I have a bunch of links that when clicked open up a detail panel underneath which displays more information. This is done ajaxy. The thing is however...if the user is not logged in it should take them to the login page and not display the panel.

So if I were to send back the user's login status from the server and then display the panel or not display the panel...would this be secure enough?? Could this be bypassed somehow??

Are there better ways to do this??

Thanks in advance.

Answer 1

Instead of sending back the login status why not send back the data for the logged in user only if the user is logged in? So you do all the logic for determining what to display on the server. The AJAX call recieves data and displays it regardless.

If you have the javascript idisplay or not display data it implies that you are sending the data to the client in any case...and that is not secure.

Answer 2

I could easily be bypassed. The user could create their own AJAX call (don't even need to do AJAX, they could just create a plain old HTTP Request), with the login flag set, and get to the data they aren't supposed to. You'd probably be better off just using the information from the session to determine if the user is logged in, an not relying on information that is sent in the AJAX request.