title: authorization in a SPA or client side app
body: <p>So I've been trying to find out best practices on how to tackle authorization, not authentication, in a SPA app. </p>
  
  <p>Say I have a client side MVC (angular, vuejs, etc ..) with an api backend, how do we manage using authorizations for the app? </p>
  
  <p>For example, a user and a manager, both can access but one has more access (features in a view) than the other. If they are both using the same UI on the client side how do you protect and render the proper view according to their access? There is the option of getting a list of their roles/claims and based on that determine what to render on the client side but since that's based on JS it can be circumvented easily.</p>
  
  <p>It sounds to me that a client side mvc app may not be the right solution and an SSR app is more fit for this. If that is the case, how about the mobile case? how do you solve the same problem for the mobile without having to develop an actual native app? </p>