Hacker News Reader

I'm hoping "isLoggedIn" / "currentUser.can" is just a convenient shortcut for conditional rendering, and the authorization is handled by the back-end?

I'm assuming that is so... Only I've seen some crazy stuff in front-end centric tutorials that seem to assume code injection isn't possible (if by malware or the js console..).

View on HN

You're correct, v-if in Vue is for conditional rendering. If the statement evaluates to false then the button isn't added to the DOM.

And you're doubly correct, the back-end better verify those requests as well. Can't trust user input, which includes HTTP requests from client apps...

Reply on news.ycombinator.com