Confusion about Management API Token Limitation

[benjamin203]

“Auth0 does not recommend putting Management API Tokens on the frontend that allow users to change user metadata. This can allow users to manipulate their own metadata in a way that could be detrimental to the functioning of the applications. It also allows a customer to do a DoS attack against someone’s management API by just spamming it and hitting rate limits.”

Does this mean that I can still safely allow users of my SPA to change their user metadata when I have that functionality set up on my back-end? Meaning that the API token is not stored on the client side?

Does the fact that an application is SPA immediately mean that you’d put the API Token on the front-end? I am confused.

[tyf]

Hi @benjamin203!

@benjamin203

Does this mean that I can still safely allow users of my SPA to change their user metadata when I have that functionality set up on my back-end? Meaning that the API token is not stored on the client side?

That’s correct!

@benjamin203

Does the fact that an application is SPA immediately mean that you’d put the API Token on the front-end? I am confused.

Yes - Typically SPAs are public clients only (no backend) and thus tokens would be stored in the browser. This opens up the app to security vulnerabilities.

I shared some more info in this post of yours, hopefully that helps as well!