security - Parse ACLs in Client -

are acls supposed go client code when using parse? seems not secure me because can't change acl code when creating new object? perhaps misunderstanding...

would appreciate clarification. thanks!

you correct. moving security client allows attack bypass security sending network messages directly server. access control must checked on server.

that said, can improve user experience if add permission-based ui elements. depending on implementation, decision show conditional elements can made on client or server. example, may wish show additional ui elements if current user has admin privileges. whether use acls directly or application-specific means of making decision largely matter of choice. key thing that, though may have conditional ui, always check permissions on server well.