Hi, When managing user roles, a common practice is to have roles defined as an option set and a field on each user profile which is the user role. The role needs to be readable by the front end for obvious reasons of hiding/showing stuff depending on the user role. How is this secured? How to pre…

If auto binding is enabled for that field by privacy rules, assume users can modify it unrestricted if they meet that privacy rule’s condition. Else, it can only be modified by workflows. Ensure that you have a condition on the role modification workflow to stop anyone running it e.g Current User’s…

Interesting question, because as far as I know Option Sets are always downloaded by the frontend and are accesible by an attacker. One would think that it won’t be difficult to change the role from console and access hidden parts of the app. However, I think that, if applied in a When page is load …

Indeed, everything hidden on the front end can be seen. Any real sensitive stuff should be hidden on the server side and never under no circumstance reach the front end. Security should always be set at the server level with backend workflow. Lets take as an example, the user signup. It seems to m…

I once had a similar question, the answer is no it cant, my question was during signup can an attacker change the custom states thus workflow triggers to have another role or signup flow. The answer is no

Thanks for the feedback, do you know how this is ensured?

[image] emir.ozgun: can an attacker change the custom states [image] emir.ozgun: The answer is no I’m curious about this assertion. As far as I know, custom states can be changed at will by an attacker. Therefore, if the Sign a user up action is setting a User’s role field based on a…

Force server-side evaluation of workflow conditionals that check user’s role. See discussion in: [image] Hard Fact - Securing your App with Server Side Conditionals Costs 0.02 WUs Tips Straight from Bubble To provide some context, any dynamic expression related to user a…

[image] ademiguel: Interesting question, because as far as I know Option Sets are always downloaded by the frontend Option Sets are but that’s not the same thing as the specific option set value in a specific field attached to a Thing use Current User is Logged in & Current User is [Role]

User roles as option sets = what if user changes its own role?

Need help App Organization

davidb April 22, 2025, 12:18pm 7

Force server-side evaluation of workflow conditionals that check user’s role. See discussion in:

Topic		Replies	Views
Setting up User Role as Option set App Organization	4	576	July 11, 2023
Option Set as User Role not working Need help	1	234	December 1, 2023
Admin and employee accounts Database	1	396	January 28, 2021
Airdev template user permissions Need help	8	856	August 22, 2022
Privacy: User Roles & Option Sets nested in User Need help	0	833	March 11, 2021

User roles as option sets = what if user changes its own role?

Related topics