Security Considerations for g_user, gs.getUser(), and Read-Only Catalog Variables

[ShumaS]

Hello Community,

I would like to understand the security implications of user information and read-only variables in Service Catalog.

My understanding is as follows, but I would appreciate confirmation from experts.

1. In a Catalog Client Script, we can use g_user to obtain information about the current user.

   • Since g_user is executed on the client side (browser), can its values be modified or spoofed by a user using browser developer tools or custom scripts?

2. In server-side scripts, we can use gs.getUser() to retrieve information about the currently logged-in user.

   • Since gs.getUser() executes on the server side, is it correct to assume that its result cannot be modified by the client and can therefore be trusted for security-related logic?

3. For catalog variables that are configured as Read Only:

   • Is the read-only setting only a UI restriction on the client side?
   • Can a user potentially modify the value through browser developer tools, API calls, or other methods?
   • If so, should all important validations be rechecked on the server side regardless of the read-only setting?

From a security perspective, I would like to confirm whether the following understanding is correct:

• g_user → Client-side object, therefore should not be fully trusted for security decisions.
• gs.getUser() → Server-side object, therefore can be trusted for security decisions.
• Read-only catalog variables → May still be susceptible to client-side tampering and should be validated on the server side.

Could anyone confirm whether this understanding is correct or provide additional best practices?

Thank you in advance.

[Ankur Bawiskar]

@ShumaS 

Your understanding is 100% correct for all the points

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Tejas Adhalrao · Accepted solution]

hi @ShumaS  ,

Yes, your understanding is correct.
g_user works on the client side, so a user can modify client-side values using browser tools. We should use it for UI purposes, but not for important security decisions.

gs.getUser() works on the server side and gets the actual logged-in user. So it is safe to use for server-side validation and security logic.

For catalog variables marked as Read Only, it is mainly a UI restriction. A user may still try to change the value through browser tools or another API.

So, for important fields or security-related logic, always validate the value on the server side. Also use ACLs wherever access needs to be restricted.