# Session.props.auth.user.roles security

**URL:** <https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126>\
**Category:** Ignition\
**Tags:** perspective, scripting\
**Created:** [October 28, 2023, 6:29pm UTC](https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126 "2023-10-28T18:29:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![joe.tamaki](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@joe.tamaki](https://forum.inductiveautomation.com/u/joe.tamaki)\
**Post date:** [October 28, 2023, 6:29pm UTC](https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126/1 "2023-10-28T18:29:07Z")

</div>

In a perspective view button script, I'm assigning session.props.auth.user.roles to a variable userRoles, then calling a project library script and passing userRoles as an argument.  
Is this a security risk? Could userRoles be altered on the client side and therefore change the roles the project library script executes with?

---

<div class="post-metadata">

**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\
**Post date:** [October 28, 2023, 7:08pm UTC](https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126/2 "2023-10-28T19:08:44Z")

</div>

It sounds like it could. Why not pass the username to the script and let the gateway check (again) what roles the user has?

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [October 28, 2023, 7:48pm UTC](https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126/3 "2023-10-28T19:48:55Z")

</div>

Is this purely a jython variable? If so, I think it is safe. All jython scripting runs in the gateway, not in the browser, so there's no attack point.

---

<div class="post-metadata">

**Author:** ![joe.tamaki](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@joe.tamaki](https://forum.inductiveautomation.com/u/joe.tamaki)\
**Post date:** [October 30, 2023, 12:39pm UTC](https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126/4 "2023-10-30T12:39:44Z")

</div>

Thanks for your responses.  
@pturmel Yes it's a purely jython variable.  
To @Transistor's point I was thinking of passing the perspective session id. Like username but someone might know or guess another person's username, it seems very hard to know or guess another session id. Then find the roles bases on session id.  
But I'm wondering if that's just making it unnecessarily complicated?

Is it a security weakness to have "roles" as a function argument when the function is initiated from a perspective session? Could a bad actor learn the function name then initiate their own call of the function and pass it different roles?

---

<div class="post-metadata">

**Author:** ![Aizhigit\_Mussali](https://avatars.discourse-cdn.com/v4/letter/a/f0a364/32.png) [@Aizhigit\_Mussali](https://forum.inductiveautomation.com/u/Aizhigit_Mussali)\
**Post date:** [October 31, 2023, 7:54am UTC](https://forum.inductiveautomation.com/t/session-props-auth-user-roles-security/81126/5 "2023-10-31T07:54:07Z")

</div>

It should be safe.

session.props.auth is a private property. It is [not readable/writable from JS](https://docs.inductiveautomation.com/display/DOC81/Perspective+Component+Properties#PerspectiveComponentProperties-RestrictingPropertyAccess).  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/d/7d785db80b9a42075f9cf6d1606700312e905bcf.png)