Security

Hilla is a combined client and server programming model. As an application developer, you make a decision about how much of the application state is stored on the server and how much is stored in the user’s browser. The following sections describe the best practices for securing such applications.

Security topics that don’t depend on the frontend framework are documented only in the main Hilla documentation: Introduction, Controlling Service Access, Accessing Auth Data, Offline Authentication, Stateless Authentication, Common Vulnerabilities, and Best Practices. Restricting access to individual views by role is documented only for React views, in Routing: the client-side router that Lit views use is deprecated and has no equivalent view configuration. In Lit views, restrict the data instead, by annotating the browser-callable services as described in Controlling Service Access.