angularjs - Angular Js Security Issues Role Based Authorisation -

i creating new enterprise application in angular company. excited angular handling roles on client side not working out me.

basically saving token when ever user log's in , before user view page authorisation request sent server role , user details based on token.

after authorisation request data page server returns entire data irrespective of role of user, after use ng-switch , render templates according role.

now problem here trying show , hide data on client side after recieve user information have keep role in scope variable or local storage anywhere on client side. point here if keep on client side can change role , access data want.

so should assume angular not fit app trying display data on client side according roles server because feel if user can see logic , data can play it.

this view

   <div ng-switch="user.data.role">        <div ng-switch-when="admin">             <h1>hello seeing dashboard admin</h1>         </div>          <div ng-switch-when="manager">             <h1>hello seeing dashboard manager</h1>         </div>     </div> 

here how fill user variable in controller

app.controller('dashoboardcontroller',  ['$scope','userservice', function ($scope, userservice) {      $scope.authentication = userservice.authentication;     $scope.user = userservice.fillauthdata();     console.log($scope.user);     $scope.greeting = "welcome! dashboard";    }]); 

this service method

   var _fillauthdata = function () {          var authdata = sessionservice.get('user');          if (authdata) {             _authentication.isauth = true;             _authentication.data = authdata;          }          console.log(_authentication);         return _authentication;     } 

session service getting user data server on basis of token. can see since view descriptive changing role in authdata not big deal.

please me if there work around this. wanted project in angular.

if web service (run on server) returns data client authenticated user not authorized access, web service (server side) has security flaw. there no way can fix client/browser side, regardless of client side framework decide chose. angularjs fine whatever want in browser, web service broken.