About this question
My question has to do with JavaScript security.
Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a problem, as the server always has the last word and will check if you're authorised to do what you want.
But what if you need a little security without involving the server? Is that possible?
For example, say you've got a client-side routing system and you want a concrete route to be protected for logged-in users. So you ping the server asking if you're allowed to visit protected routes and you go on. The problem is that when you ping the server, you store the response in a variable, so the next time you go to a private route, it will check that if you're already logged in (no ping to the server), and depending on the response it will go or not.
How easy is it for a user to modify that variable and get access?
My security (and JavaScript) knowledge isn't great. But if a variable is not in global scope and is in the private part of a module pattern which only has getters but not setters, even in that case, can you hack the thing out?
