WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
JavaScript Congress • Nov 25, 2021

Full-stack role-based authorization in 45 minutes

Bartosz Pietrucha

Hiding frontend UI buttons isn't real security. Master true full-stack role-based access control across your Angular client and Node.js backend in just 45 minutes.

Pause
Mute Enter Fullscreen
#1 about 5 min

Introduction to user authentication and authorization concepts

Differentiating between identity verification and access authorization establishes a strong foundation for full-stack security patterns.

#2 about 4 min

Domain modeling for multi-user scalable account systems

Structuring domain models around localized account boundaries simplifies the enforcement of strict data access controls.

#3 about 3 min

Sharing domain model implementations between frontend and backend

Referencing backend TypeScript models directly in frontend environments prevents error-prone code duplication across the stack.

#4 about 4 min

Designing business rules for account-level entity permissions

Defining strict ownership scenarios and role constraints controls how disparate users interact with shared cloud entities.

#5 about 2 min

Creating secure API routing architectures using URL prefixes

Dividing REST endpoints with distinct path prefixes establishes clear defensive boundaries across stateless API layers.

#6 about 2 min

Representing user rights through stateful or stateless authentication

Transmitting user role information natively through web tokens ensures the user interface dynamically reflects valid permissions.

#7 about 5 min

Implementing frontend route protection using Angular router guards

Encapsulating view availability with frontend routing limits navigation without replacing the need for authentic backend enforcement.

#8 about 5 min

Securing API requests with frontend interceptors and backend middlewares

Binding authorization tokens natively through client interceptors ensures server-side middleware processes restricted data queries automatically.

#9 about 3 min

Building custom structural directives for role-based component visibility

Abstracting redundant conditional checks inside custom Angular syntax streamlines the deployment of role-specific frontend components.

#10 about 9 min

Demonstrating role-based access control in a full-stack application

Intercepting unauthorized network requests directly from compromised clients illustrates the absolute necessity of server-side data validation.

#11 about 7 min

Implementing seven essential steps for modern web security

Evaluating architectural trade-offs against established industry checklists ensures comprehensive protection against malicious external payloads.

Matching moments

9:56 min

Final code walk-through and audience Q&A session

Germán Álvarez · LIVE

2:12 min

Shift of security responsibilities to frontend developers

Jakub Andrzejewski · WWC 2023

2:31 min

Securing REST APIs with JSON tokens and role access

Rustam Mehmandarov Rustam Mehmandarov · WWC 2025

3:54 min

Protecting Java microservices with role-based access

Thomas Südbröcker · LIVE

6:41 min

Audience questions on database architecture and security

William Lyon · LIVE

3:26 min

Designing APIs for security from day one

Philippe De Ryck · LIVE

More from JavaScript Congress

The Eternal Sunshine of the Zero Build Pipeline thumbnail
50:10
over 4 years ago

The Eternal Sunshine of the Zero Build Pipeline

Teini - an extremely small webshop leveraging awesome and free tech thumbnail
40:45
over 4 years ago

Teini - an extremely small webshop leveraging awesome and free tech

Christian K

Native Web Apps: Are We There Yet? thumbnail
44:40
over 4 years ago

Native Web Apps: Are We There Yet?

Maxim Salnikov

Modern Web Development with Nuxt3 thumbnail
41:43
over 4 years ago

Modern Web Development with Nuxt3

Alexander Lichter

Making neural networks portable with ONNX thumbnail
54:49
over 4 years ago

Making neural networks portable with ONNX

Ron Dagdag

JavaScript the Grumpy Parts thumbnail
46:08
over 4 years ago

JavaScript the Grumpy Parts

Rob Richardson

Upcoming sessions on this topic

Open session

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Zero-Trust Architecture for Agentic AI: Securing Multi-User Access and Third-Party Integrations

Borko Djurkovic

Member of Technical Staff at Cohere

Borko Djurkovic
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale

Yoav Gal, Dor Cohen

Yoav Gal
Dor Cohen

Related videos

Un-complicate authorization maintenance thumbnail
1:00:00
LIVE • over 2 years ago

Un-complicate authorization maintenance

Alex Olivier

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
WWC 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Architecting API Security thumbnail
47:34
LIVE • over 4 years ago

Architecting API Security

Philippe De Ryck

Meet Your New BFF: Backend to Frontend without the Duct Tape thumbnail
51:04
LIVE • almost 3 years ago

Meet Your New BFF: Backend to Frontend without the Duct Tape

Noam Honig

A Primer in Single Page Application Security (Angular, React, Vue.js) thumbnail
36:39
LIVE • over 5 years ago

A Primer in Single Page Application Security (Angular, React, Vue.js)

Thomas Konrad

Bullet-Proof APIs: The OWASP API Security Top Ten thumbnail
25:46
WWC 2025 • 12 months ago

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.