The peering portal has an operator-only field: type an ASN and see what the suggestion engine would offer that network. It is meant for me. For a while, everybody could see it.
Setting hidden isn’t enough
The code did the obvious thing:
field.hidden = !isOperator;Browsers implement that attribute with a user-agent stylesheet rule, [hidden] { display: none }.
Mine is a plain element rule, so it has the lowest specificity there is — and the field also
matched a rule of my own:
.lg-field { display: flex; }A class beats an element, so display: flex won, and the attribute did precisely nothing.
The fix is one line, and it belongs in every stylesheet that toggles hidden from script:
[hidden] { display: none !important; }Why it was embarrassing, not dangerous
The field was cosmetic. The portal re-checks on every request whether the logged-in PeeringDB identity is on an explicit operator allowlist — an allowlist of identities, not of ASNs, so a co-administrator of my own AS does not inherit it either. Anyone who found the field and typed an ASN into it got a 403.
That is the actual lesson. The UI hid something it had no business being trusted to hide, and it hid it badly, and it did not matter, because the decision was being made on the server as well. Client-side hiding is a convenience for the user. It is never the control.