On my Single Page App I am using MSAL.js to authenticate users and to also extract the groups they belong to by using Microsoft Graph endpoints. I save to a variable the Specific groups the user belongs to. According to the content of that variable, a different Home Page will be rendered. The code looks like this:
if (user.group == 'AppAdmin') {
return (
<div className='h1'> Admin Dashboard</div>
);
} else if (user.group == 'AppManager') {
return (
<div className='h1'> App Manager Dashboard</div>
);
} else {
return (
<div className='h1'> User Dashboard</div>
);
}
user.group contains the group the user belongs to in Active Directory.
Will an end user not belonging to the AppAdmin or AppManager groups be able to modify in their web browser the variable user.group value to fool the browser into rendering admin or manager content?
