If you mean user authentication/authorization - there is none. It is not in the Drab’s scope. If you mean how user may tamper with requests (running event handlers in the controller) - I built it with security in my mind. There is always a token, values stored in the client side are always signed.
For the new module, Drab.Live, where you can update assigns you had in the template, live - all the expressions are stored in DETS on the server side, so the client knows only hashes of them.
Magic is good!
As a first step of Drab, I’ve created an API to have the jQuery methods on the browser side. Not very easy to learn, even I need to take a look on docs from time to time. No magic, just work.
Magic is coming in the second step (upcoming v0.5.0):
Imagine you’ve rendered the template in the controller. This page is now showed in the browser. And magically, using Drab.Live, you may update your assigns, remotely. No need to change the template, no need to learn a new framework, except two functions peeking and pokeing your assigns from/to page. Minimum to learn.
First functionality is already working, check out https://tg.pl/drab/live.
