Security: disable feature flag at client-side

[adisutanto]

Security: The proxy evaluates the features for the user on the server-side and by default only exposes results for features that are enabled for the specific user. No feature toggle configuration is ever shared with the user.

What if the API response to client-side is intercepted and modified to feature disabled?
Would an attacker be able to disable an enabled feature?
Is this a security vulnerability?

[daveleek]

Hello @adisutanto!

What if the API response to client-side is intercepted and modified to feature disabled?
Would an attacker be able to disable an enabled feature?

Yes, but you should be using SSL for the traffic, also between Unleash and your internal services, along with allowing proper certificate chain validation. That's the typical way of dealing with potential MITM attacks