从<div>添加/删除<button>吗？

Question

Objective

The goal is to provide features for inventory management for the authenticated users. Other visitors can consult the inventory only, and filter their findings.

Authentication

The authentication is through the ajaxSession() javascript function as described here.

1. PHP / Ajax : How to show/hide DIV on $_SESSION variable value? (See answer)
2. PHP: $_SESSION doesn't seem to get set. Any idea?

Now, the $.ajax() delegate gets the right answer from the PHP server. Now, I though of simply use CSS classes .hide and .show, but it doesn't seem to be a good idea for security reasons.

The ajaxSession() function

function ajaxSession(actionUrl) {
    $.ajax(function() {
        url: actionUrl
        success: function(authenticated) {
            if (authenticated == 'true') {
                // create buttons here.
            } else {
                // ensure to empty those div
            }
        }
    });
}

N.B. There are other members set in the $.ajax() call, but the important is there.

Answer 1

The security mechanisms should be implemented on the server side!

There won't be a security vulnerability if you create some login-specific buttons in your JS. Just be sure that you don't output sensitive data from your backend (PHP) or that you perform any unauthorized operation (again from your backend).

Always check on the server side (for each operation) that the user is authorized!
Store the login state in a session or the like. Don't rely on a URL parameter like isLoggedIn=1 or POST data. They come from the client. Clients are always the untrusted parts in an application.