On our web application we have a form that users can use to edit details for a particular object. In the form there is one field that requires elevated permissions to update.
On the UI, we hide that field if the user doesn't have the correct permissions to change it.
We are unsure of the best action to take during server side validation if the user attempts to by-pass the front-end validation and change the field, we could;
- Throw an error and prevent the whole save action
- Save the record with the rest of the changes without modifying the secure field
Is the a generally accepted best practice for this situation?