Security Considerations for g_user, gs.getUser(), and Read-Only Catalog Variables

[ShumaS]

Hello Community,

I would like to understand the security implications of user information and read-only variables in Service Catalog.

My understanding is as follows, but I would appreciate confirmation from experts.

1. In a Catalog Client Script, we can use g_user to obtain information about the current user.

   • Since g_user is executed on the client side (browser), can its values be modified or spoofed by a user using browser developer tools or custom scripts?

2. In server-side scripts, we can use gs.getUser() to retrieve information about the currently logged-in user.

   • Since gs.getUser() executes on the server side, is it correct to assume that its result cannot be modified by the client and can therefore be trusted for security-related logic?

3. For catalog variables that are configured as Read Only:

   • Is the read-only setting only a UI restriction on the client side?
   • Can a user potentially modify the value through browser developer tools, API calls, or other methods?
   • If so, should all important validations be rechecked on the server side regardless of the read-only setting?

From a security perspective, I would like to confirm whether the following understanding is correct:

• g_user → Client-side object, therefore should not be fully trusted for security decisions.
• gs.getUser() → Server-side object, therefore can be trusted for security decisions.
• Read-only catalog variables → May still be susceptible to client-side tampering and should be validated on the server side.

Could anyone confirm whether this understanding is correct or provide additional best practices?

Thank you in advance.